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HEARING ON SBA COMPUTERIZED LOAN 
MONITORING SYSTEM: A PROGRESS REPORT 


TUESDAY, FEBRUARY 29, 2000 


House of Representatives, Subcommittee on Gov- 
ernment Programs and Oversight, Committee on 
Small Business, 


Washington, DC. 

The subcommittee met, pursuant to call, at 10:00 a.m., in Room 
2360, Rayburn House Office Building, Hon. Roscoe Bartlett [chair- 
man of the subcommittee] presiding. 

Chairman Bartlett. Good morning. Let me convene the Sub- 
committee on Government Programs and Oversight of the House 
Committee on Small Business. 

Before I begin, let me note that we are this morning nationwide 
live on the Net, so if you would please speak into your microphone 
so that the system can pick it up clearly. 

Good morning and welcome to this hearing of the Subcommittee 
on Government Programs and Oversight of the Committee on 
Small Business. A special welcome to those who have come some 
distance to participate and to attend this meeting. 

Today we will examine a matter that is of great importance to 
the taxpayers who expect the 7(a) government guaranteed loan pro- 
gram to be well managed and remain solvent. The hearing is im- 
portant to Congress in its oversight role and to the U.S. General 
Accounting Office which is responsible through the audit function 
to provide accurate information as to the financial condition of fed- 
eral government programs. And this hearing should be of impor- 
tance to the Small Business Administration known here in Wash- 
ington as “SBA” the federal agency that is responsible for the day- 
to-day direction of the 7(a) loan program. 

Section 233 of the Small Business Reauthorization Act of 1997 
(Public Law 105-135) requires that SBA complete eight mandated 
planning actions before the agency obligates or expends any funds 
for the development and implementation of the proposed new, auto- 
mated 7(a) loan monitoring system. It would seem only a matter 
of common sense that the planning phase should be completed be- 
fore an agency makes major software and hardware purchases for 
a new computer system. 

The proposed new automated loan monitoring system for the 7(a) 
loan program was the subject of a prior hearing of this Sub- 
committee held on July 16, 1998. We were encouraged by testimony 
at that hearing that the Small Business Administration had a 
project plan, but none of the eight planning steps had been com- 
pleted. 


( 1 ) 
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We in Congress support the Administrator’s initiative in relying 
more on the private sector in the 7(a) loan program. We support 
SBA’s turning over to hometown bankers the decision to originate 
loans and the responsibility for servicing and liquidating loans. 
Certainly the local banker has more knowledge of the lender and 
his or her credit worthiness than bureaucrats located some dis- 
tance from the community in which the loan is made. 

Also, there is a broad-based support in Congress for the Adminis- 
trator’s efforts to modernize SBA’s systems and outlook. There is 
also broad-based support for the Administrator’s goal for the 7(a) 
loan program that is, to get SBA out of the loan application ap- 
proval business altogether and to assume the role of overseer of the 
lending institutions. 

This hearing will focus on the progress SBA has made, since the 
July 16, 1998 hearing, in performing and completing the planning 
needed to serve as the basis for funding the development and im- 
plementation of the 7(a) loan program computerized loan moni- 
toring system including the eight planning steps required by the 
Act. 

At this hearing today, we would appreciate your assessment of 
(1) whether any planning has been completed as of today, (2) the 
management decisions made as a result of that planning, (3) the 
planning remaining to be completed, and finally (4) the manage- 
ment decisions remaining to be made. Further, we would like to 
know the extent to which SBA has involved the lenders in the 
planning process. Lastly, does the planning for the system include 
maximizing opportunities to reduce needless paperwork, regulatory 
burden and costs borne by the borrowers, lenders and SBA? 

It would be unacceptable for SBA to ignore the law and the will 
of Congress expressed in Section 233 of the 1997 Small Business 
Reauthorization Act. It would be unacceptable for SBA to bypass 
accepted system development standards and essential planning 
steps. No successful business could omit prudent planning. It is in- 
cumbent upon Congress and the U.S. General Accounting Office to 
see that a federal agency does not engage in wasteful, willy-nilly 
project management. 

In a nutshell, the purpose of this hearing is to hold SBA’s feet 
to the fire to make sure that they complete the eight planning 
steps required by law before the agency spends any taxpayers’ 
money to buy software or hardware for a new automated computer 
system for monitoring its 7(a) loan portfolio. 

Again thank you all for participating in this hearing. And thank 
you in the audience for attending this hearing. 

And we are pleased today to be joined by Mr. Danny Davis, 
Ranking Democrat on our subcommittee, and would now turn to 
him for any opening remarks that he would care to make. 

[Mr. Bartlett’s statement may be found in appendix.] 

Mr. Davis. Thank you very much, Mr. Chairman, and first of all 
let me commend you for calling this hearing today to review the 
progress of the Small Business Administration’s Automated Loan 
Monitoring Program. 

As we all know. Section 233 of the 1997 SBA Reauthorization 
Act, PL-105-135, mandated that SBA perform the necessary plan- 
ning to implement the computerized loan monitoring system. Mod- 
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ernization of SBA’s loan monitoring system is critical to the sur- 
vival of our small businesses, as it will help expedite loans in a 
more efficient and timely manner. This is most important to those 
programs which embody 7(a) programs and disaster assistance. 

As a member of this committee, I have worked tirelessly to see 
that all members of this country receive a fair and equitable treat- 
ment from the Small Business Administration regarding access to 
capital. I have also seen the same commitment from the Small 
Business Administration. First, completing the modernization of 
SBA’s Loan Monitoring Program will enable everyone here to 
evaluate the progress made by the Small Business Administration 
concerning access to capital. Therefore, the full implementation of 
the SBA plan is critical to the success of the SBA and small busi- 
nesses who need the services that it provides. 

I have complete confidence that the Small Business Administra- 
tion and this committee will work together to that end. It is cer- 
tainly encouraging to see the progress that has been made. It is en- 
couraging to know that the Small Business Administration is deal- 
ing with what I consider to be, especially in much of the commu- 
nity that I represent, access to capital has and continues to be one 
of the most significant barriers to the development of small busi- 
ness, especially by minority groups and women. 

So, I thank you, Mr. Chairman, for this hearing. I look forward 
to the testimony that we are going to hear today, and thank all of 
those who have come to participate. 

Thank you. 

Chairman Bartlett. Thank you very much, and I would like 
now to welcome our witnesses. 

Let me say first that your prepared testimony will, without objec- 
tion, be included as a part of the record, so we would encourage 
you to summarize in any way that you see fit. 

Our witnesses today are Fred Hochberg, Deputy Administrator, 
Small Business Administration, then Anthony Wilkinson, President 
and CEO of the National Association of Guaranteed Lenders, Inc., 
and Joel Willemssen, Director, U.S. General Accounting Office. 

Chairman Bartlett. Mr. Hochberg, we would be pleased to get 
your testimony first. 

Thank you. 

STATEMENT OF FRED P. HOCHBERG, DEPUTY 

ADMINISTRATOR, U.S. SMALL BUSINESS ADMINISTRATION 

Mr. Hochberg. Thank you. 

Mr. Chairman and Congressman Davis, my oral testimony will 
address the questions that you raised, Mr. Chairman, in your open- 
ing statement, and all of what we are doing here will also address 
issues of access to capital, because we will have far better informa- 
tion from our lenders, where loans are being made, and where they 
are not being made, as a result of our efforts through this program. 

Good morning, Mr. Chairman and Members of the Sub- 
committee. Thank you for inviting the U.S. Small Business Admin- 
istration to testify about the progress we have made in planning 
for the implementation of our Loan Monitoring System. My name 
is Fred Hochberg, Deputy Administrator of the SBA. By way of in- 
troduction, I should add that I come to the SBA from the business 
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world. I served as President and Chief Operating Officer of the Lil- 
lian Vernon Corporation, a business founded by my mother which 
I guided from $6 million to $170 million over the course of 18 
years. 

One of the projects I undertook at the company was a complete 
enterprise-wide overhaul of my company’s computer operations. 
But, before I get started I’d like to just brag a little bit. In yester- 
day’s issue of Forbes magazine, the title is “Best of the Web,” the 
SBA was cited as having the best web site. You can find that on 
page 76 of yesterday’s Forbes magazine. So, we are developing a 
very strong IT program at the SBA and we are glad that Forbes 
recognizes it. 

Joining me today are some of the senior executives who are re- 
sponsible for the Loan Monitoring System. Behind me, you will find 
Kris Marcy, our Chief Operating Officer, Larry Barrett, Chief In- 
formation Officer, Charles Tansey, Associate Deputy Administrator 
for Capital Access, and Joe Loddo, our Chief Financial Officer. We 
are appearing on behalf of SBA Administrator, Aida Alvarez, whose 
schedule did not permit her being with us today. 

Despite her absence, the Administrator is deeply committed to 
transforming the SBA into a 21st century institution, using the 
best practices of the private sector, as well as the most recent ad- 
vances in technology. Let me summarize my rather lengthy state- 
ment, and I thank you for including this as part of the official 
record as well. 

SBA’s legislative mandate is quite clear. Simply put, our man- 
date is to serve as a gap lender, to ensure that those small busi- 
nesses who do not have access to traditional means of capital have 
the funds necessary to start or grow their businesses. Our success 
in carrying out this mission has been nothing short of phenomenal. 
Since 1990, our loan portfolio has grown from $17.5 billion to over 
$50 billion. We now guarantee between 45,000 and 50,000 loans a 
year, three times the amount in 1990. And, we have made funda- 
mental, major changes to the way we do business. 

Just a few examples. Now, all routine servicing is handled in our 
centralized business and disaster loan centers. Seventy-five percent 
of all loans bypass the district offices. SBA has reduced burden- 
some paperwork and increased efficiency with the SBAExpress and 
LowDoc programs, programs that help borrowers needing less than 
$150,000.00 in capital. 

We have completed our first round of safety and soundness re- 
views of the small business lending companies and are in the midst 
of our second round. This is a first for the SBA. 

In accordance with our legislative directive, SBA now contracts 
out about a third of its disaster loan servicing. Seventy-five percent 
of our business loan portfolio is now serviced by the private sector, 
our lending partners, and we launched our first ever asset sale, 
which was quite successful, last August. 

And, we did this with 22 percent fewer employees over the last 
decade. Obviously, this meant that the way we deliver programs 
had to change dramatically. You might say at this point, well, this 
is all well and good, but why not centralize even more. The answer 
goes back to our legislative mission, small businesses, new busi- 
nesses, businesses without long credit histories, have special needs. 
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Just look at the current crisis in the home heating oil industry in 
New England, and I should add in Maryland. If banks were to send 
these loan requests from these small oil companies to our Sac- 
ramento processing center, they might well be turned down. Many 
of these companies have no borrowing history, many of them need 
technical assistance, and it does take local knowledge of the local 
marketplace to make these loans work. We must give these small 
companies the loans coupled with technical assistance to help them 
get back on the road to recovery. 

We are all for centralization, but only if we can use it effectively 
in assisting our small business clients. SBA once made loans di- 
rectly and did the credit reviews directly. Now, as I mentioned, 75 
percent of all business loans are being made by our lending part- 
ners, with no or limited credit review by the SBA. This presents 
a level of risk, which you noted in your letter of invitation to this 
hearing, and this concern, Mr. Chairman, is why the agency began 
planning for a Loan Monitoring System back in 1996 and made its 
first funding request to Congress in February of 1997. 

Our computer systems were originally designed 20 years ago, 
when SBA’s once primary function was direct loan making. Simply 
put, our systems have not fully evolved to meet the challenges and 
the way our loan products are now being delivered by lenders. It 
is critical that SBA develop a computer system that allows us to 
rapidly identify and respond to variations in lending patterns. 

Two major challenges face us as we move ahead. First, as a re- 
sult of recent changes in the nation’s banking laws, the face of 
lending has changed and changed dramatically. And, the industry 
has become increasingly polarized as mergers among large and me- 
dium-sized lenders have created a core of very large multi-state 
banks on one hand, and left an equally large number of rural and 
small banks on the other. 

Secondly, we are challenged by the fact that technology systems 
are evolving rapidly. When we first began planning in 1996, the 
full power of the Internet was just beginning to be realized. And, 
its potential as a consumer banking forum was understood hardly 
at all. 

In 1998, 6.9 million households were banking on line. The num- 
ber is expected to grow to over 24 million by 2002. Thirty-nine of 
the largest consumer banks in the U.S. now offer Internet bill pay- 
ment, up from just 17 a year ago. SBA must be able to keep pace 
or we will be bypassed. 

Mr. Chairman, you are a scientist with numerous patents to your 
name. I understand you’ve held key positions in research and de- 
velopment. You, probably better than most, understand how critical 
it is to keep up with technology. I know that you and this sub- 
committee recognize the importance of our developing an effective 
Loan Monitoring System for all our loans, not just 7(a) and 504. 

I recognize the contribution this subcommittee has made by out- 
lining the planning steps which, along with the Clinger-Cohen Act, 
have guided the development of our system thus far. In fact, since 
the 1997 SBA Reauthorization Act, we have worked closely with 
the staffs of the House and Senate Small Business Committees and 
subcommittees, our appropriators and the General Accounting Of- 
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fice, to design a system which makes sense for all of our small 
business clients, and lending partners, and our staff. 

As you requested, I have included a detailed description of the 
work we have done to fulfill the eight planning steps in my written 
testimony. These steps have proved to be beneficial. I am pleased 
with the work we have done thus far. We are now ready to go for- 
ward. 

Let me summarize here some aspects of the planning work re- 
lated to the benchmarking and business process reengineering. 
And, in fact, just yesterday we completed one additional step, 
which was pending and is now in final. 

The purpose of benchmarking was to identify the best practices 
of organizations. At the beginning, our contractor, Booz-Allen & 
Hamilton, emphasized the fact that none of the organizations iden- 
tified in the benchmark report performed precisely the same func- 
tion as the SBA. Freddie Mac, in its multi-family program for ex- 
ample, deals with about 40 banks. SBA does business with over 
6,000. The quasi-government entities we studied, like Freddie Mac 
and Fannie Mae, are also significantly different from the SBA, be- 
cause they are involved in housing rather than commercial loans. 
Housing loans tend to be more homogenous. Conventional lenders 
in the study do not have SBA’s mission of providing financing to 
those who do not have access to credit on reasonable terms. The 
difference is mainly due to our role as a gap lender, which I men- 
tioned earlier. Nevertheless, their systems provided very good mod- 
els for the SBA to use in developing our Loan Monitoring System. 

There was one underlying theme throughout the benchmarking 
process, our inability to capture and analyze information which re- 
sults in increased taxpayer exposure to credit risk. Booz-Allen & 
Hamilton recommended that systems be developed that would ob- 
tain information at loan origination and then automatically and 
seamlessly transfer the information throughout the organization. 

I know that you are particularly interested in the use of credit 
scoring. Greater use of credit scoring to make objective, standard 
determinations of front-end risk was identified in the bench mark- 
ing process. By the summer of 2000, SBA plans to begin using cus- 
tomized credit scoring to expedite the decision-making at its 
LowDoc centers. Specifically, when a loan guarantee request re- 
ceives a credit score in the low risk range, the credit scoring proc- 
ess will replace one of the two manual credit reviews now required 
for loan approval. 

The use of credit scoring, however, must be balanced. Credit 
scoring is not viable for new businesses and first-time borrowers, 
nor does it factor in anticipated business cash flows or other factors 
that SBA uses to determine ability to repay. 

SBA’s BPR represented an important step in the agency’s mod- 
ernization planning. The BPR study was conducted from December 
of 1998 through June of 1999, with a 40-member team composed 
of a cross section of SBA field and headquarter staff. The team rec- 
ommended incorporating technology advances that were not even 
available five years ago. After the BPR, we made a number of man- 
agement decisions. Using GAO’s BPR Assessment Guide, SBA con- 
ducted a feasibility study. Senior management and a panel of pro- 
gram experts, who are not part of the BPR team, reviewed the 38 
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recommendations. Ultimately, 30 of the 38 recommendations were 
adopted without any change. The remaining eight were adopted 
with slight modifications to better meet our legislative mission as 
a gap lender. 

Then, at the October field managers conference, SBA’s senior 
staff reviewed the future role of the district office and the degree 
of appropriate centralization and decentralization. That subject was 
fully discussed and debated. In December, following review by sen- 
ior staff, the Administrator adopted the recommendations of the 
feasibility study mentioned above. 

What are the hallmarks of our Loan Monitoring System? We’ll be 
electronic with our lenders. We will be paperless. We will use high- 
quality data and be timely. We’ll hold lenders to strict performance 
standards. We will proactively perform risk management. We will 
strengthen our ability to do timely and accurate subsidy rate cal- 
culations. 

Mr. Chairman, we have created a safe system. We can handle 
the challenge of doing business electronically. We have worked 
with the public key infrastructure group as we set up a secure 
Internet site for conducting SBA business and tested the use of dig- 
ital signatures. We have two solid years of experience in addressing 
cyber intrusions and threats. SBA has taken aggressive steps to 
implement a proactive computer security program, including Inter- 
net monitoring, fire walls and two-step authentication to gain ac- 
cess to our site. 

As a result of the planning process, we are ready to begin the 
initial development of the system. No further management deci- 
sions remain to be made for Iteration One. Also, we have nearly 
completed orientation of our field staff who will be using the new 
system. We will continue to solicit feedback from our private sector 
lending partners. We have been meeting with them monthly to im- 
plement a system which will work best for them, too. These forums 
are an essential ingredient to ensure we develop a system that 
works for the SBA, our lending partners, and small business own- 
ers. 

Mr. Wilkinson will further elaborate on that. 

I stress that we are ready to begin the initial implementation of 
the system. Through extensive consultation with GAO, we have re- 
cently provided greater detail on Iteration One, which we believe 
demonstrates that we are ready to begin. We will continue to work 
closely with GAO as we evaluate this prototype effort. We have 
purposely adopted an evolutionary or iterative approach. It is less 
risky. We are mindful of the mistakes that have caused other orga- 
nizations to stumble. 

Let me go back to our commitment. I hope I have convinced you 
that Administrator Alvarez and I, backed by the team who are sit- 
ting behind me, are totally committed to bringing the best of the 
technology to our agency. We will use electronic commerce in every 
facet of our operations, using it in our work and communications 
with every member of our staff and SBA family, our resource part- 
ners, and our small business clients. We are modernizing, and we 
are mindful of the risk associated with major IT projects. We are 
also aware of the greater risk of not proceeding. 
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As a result of our planning, we are now fully appreciative of the 
exposure we face. As stewards of federal resources, our failure to 
proceed would be irresponsible and imprudent. 

Thank you for inviting the SBA to discuss with you the Auto- 
mated Loan Monitoring System. I appreciate your continued sup- 
port of this effort, and I ask for your support in the future. 

I’d be happy to answer any questions you may have. 

[Mr. Hochberg’s statement may be found in appendix.] 

Chairman Bartlett. Thank you, Mr. Hochberg. 

We now will turn to Mr. Wilkinson for his testimony. 

STATEMENT OF ANTHONY R. WILKINSON, PRESIDENT AND 

CEO, THE NATIONAL ASSOCIATION OF GUARANTEED LEND- 
ERS, INC. 

Mr. Wilkinson. Good morning, Mr. Chairman, Congressman 
Davis, Congressman Toomey. My name is Tony Wilkinson, and I’m 
the President and CEO of the National Association of Government 
Guaranteed Lenders, or NAGGL as we like to call it. We represent 
nearly 700 lenders and other program participants who cumula- 
tively make approximately 80 percent of the 7(a) loans guaranteed 
by the SBA annually. We thank you for holding this hearing today 
and requesting our input on SBA’s automation efforts. 

I have learned today that one of the other reasons I was asked 
to be here today was to help bring the average size of the testi- 
mony down. My two colleagues have done an excellent job in cov- 
ering the technical sides of the issue in front of us, and I’m going 
to speak briefly on what is going on from the lender’s perspective. 

Over the last decade, the SBA 7(a) loan program has experienced 
tremendous growth. What once was a fairly small program is today 
a $10 billion plus program. In the early part of the 1990s, the SBA 
processed the majority of the 7(a) loans. To better leverage private 
sector resources, so that we could provide access to capital, this 
process had to change and we had to rely more on preferred lend- 
ers and other means to deliver the product, and that has happened. 
This transformation is well underway at the SBA, and as Mr. 
Hochberg just said, 75 percent of all 7(a) loans last year were proc- 
essed under the PLP program or other limited review procedures. 
So, again, the SBA is now better leveraging private sector re- 
sources, providing greater access to capital to small business, and 
doing so with fewer employees. 

An integral part of SBA’s success will be the development and 
implementation of the new Loan Monitoring System, and from the 
lender’s perspective this will be no easy task. The agency must deal 
with the smallest of community banks, all the way up to the larg- 
est multi-district commercial banks, and non-bank lenders. These 
banks and lenders serve various geographical areas, so the needs 
of the lenders that will be involved in this new Loan Monitoring 
System are very different, and SBA has had a challenge in figuring 
out how to meet the needs of both extremes and every lender in 
the middle. 

We agree that the SBA must gather sufficient data to manage its 
loan portfolio in a responsible manner, while not creating a report- 
ing burden on either the borrower or the lender. 



9 


NAGGL thanks the SBA for the ongoing dialogue that we’ve had 
with our Automation Committee. It’s been a pleasure to work with 
Mr. Hochberg and his staff, and from our perspective they are 
doing an excellent job in putting together the new Loan Monitoring 
System. 

We hope this dialogue will continue. We do have regularly sched- 
uled meetings, and we hope this continues especially since we are 
nearing the stage of refinement. One of the things that we are look- 
ing for in the not too distant future is a set of specifications with 
the data file elements that will help our lenders determine what 
we will have to do to comply with the new Loan Monitoring Sys- 
tem. 

NAGGL concurs that the Internet should be the standard me- 
dium for submitting loan applications and servicing actions. Reli- 
ance on the automated flow of information should create effi- 
ciencies both with the lender and SBA. We also appreciate SBA’s 
willingness to work with lenders who are not technologically capa- 
ble, by agreeing to accept applications by paper. 

As well as having ongoing dialogue with the lending community, 
we hope that SBA is having a similar dialogue with their current 
contractors to make sure that they can specifically integrate their 
computer systems with what the SBA is planning. Hopefully, this 
will maximize results and there will be no duplication of efforts. 

As equally important to the process of collecting the data, is the 
establishment of performance standards by which lenders will be 
reviewed. The SBA has recently established the Office of Lender 
Oversight, and it is our understanding that development of per- 
formance standards is one of high priority. NAGGL has long said 
that the SBA needed to be in the business of lender oversight, and 
we hope to work with the agency to develop performance standards 
that are appropriate to protect SBA’s interests, but also reasonable, 
fair and focused on compliance with SBA rules. 

Mr. Hochberg said in his testimony, both written and verbal, 
that one of the uses of the data collected in the new Loan Moni- 
toring System will be to predict more accurately the future cash 
flow of loans and help with subsidy rate calculation. We, at 
NAGGL, hope this actually happens. For the last several years, the 
Administration has materially overestimated the cost of the 7(a) 
program by using a default estimate that is much higher than ac- 
tual defaults. This means that borrowers are being charged fees 
higher than necessary. 

In just the last few years, the Office of Management and Budget, 
per the agency’s Fiscal 2001 budget request, now says they over- 
estimated the cost of the 7(a) program by a total of $1 billion. Com- 
pared to the request of 7(a) appropriation for Fiscal 2001 of only 
$142.6 million, this to us is a serious problem. But, even though 
0MB has reported they overestimated the cost of the program in 
the past, primarily due to excessive default estimates, they did not 
change the default estimate, or materially change the default esti- 
mate, for Fiscal 2001. 0MB is still using a default estimate that 
we believe is more than 40 percent higher than necessary. A 40 
percent decline in the default estimate in the subsidy model would 
mean a 7(a) program subsidy rate of approximately zero. We would 
not need an appropriation for Fiscal Year 2001. NAGGL would ap- 
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preciate any help this committee could provide in helping obtain a 
more reasonable and fair subsidy rate calculation for the 7(a) pro- 
gram. 

Mr. Chairman, thank you for the opportunity to appear today, 
and I’d be happy to answer questions. 

[Mr. Wilkinson’s statement may be found in appendix.] 

Chairman Bartlett. Thank you very much. 

Now we welcome Mr. Willemssen, and look forward to his testi- 
mony. 

Thank you. 

STATEMENT OF JOEL C. WILLEMSSEN, DIRECTOR, CIVIL 

AGENCIES INFORMATION SYSTEMS, ACCOUNTING AND IN- 
FORMATION MANAGEMENT DIVISION 

Mr. Willemssen. Thank you, Mr. Chairman, Ranking Member 
Davis, Congressman, thank you for inviting GAO to testify today. 
As requested. I’ll briefly summarize our statement. 

Overall, SBA has made substantial progress in completing the 
eight mandated planning actions for its Loan Monitoring System. 
SBA has now completed final or draft products for each of those re- 
quired actions. For example, SBA has benchmarked its business 
processes against those of leading organizations, and has conducted 
a reengineering study to identify and select new processes to im- 
prove its operations. The reengineering study addressed the key 
business functions within SBA, such as guarantee procedures and 
lender oversight, and made numerous recommendations for improv- 
ing the agency’s business processes. 

SBA has also started to identify the data needed for the proposed 
Loan Monitoring System, begun defining data quality standards, 
started addressing the target information architecture, initially de- 
fined system requirements, and estimated the costs to complete the 
project. Based on the results of the reengineering study, SBA has 
developed a general description of the Loan Monitoring System. 
The system is expected to be on line to all users around the clock. 
Internally, SBA staff are to have access to records from anywhere 
in the agency, while externally the system is expected to allow 
lenders to view their own portfolios. SBA plans to have the Loan 
Monitoring System linked to the Internet and be integrated with 
a secure web site. Currently, SBA estimates that the new system 
will cost about $27.7 million. 

While SBA has made substantial progress in its planning for the 
Loan Monitoring System, it still must take a number of actions to 
reduce the project’s risk. Let me highlight just some of those key 
actions. 

First, SBA needs to identify the costs and benefits of a range of 
business process and systems alternatives to provide greater assur- 
ance that it is pursuing the most cost effective options. 

Second, SBA needs to ensure that the system it is building will 
be integrated with its future agency-wide information technology 
architecture, so that the Loan Monitoring System will be able to 
work seamlessly with SBA’s other systems. 

Third, SBA needs to make sure that it implements plans for im- 
proving data quality, including defining standards and developing 
a schedule of actions to include data quality in the current systems. 
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Fourth, SBA needs to make sure it’s defined key requirements 
for the Loan Monitoring System before proceeding with develop- 
ment. 

And finally, SBA needs to provide a clear rationale for why auto- 
mation of many of its business functions must be custom developed, 
rather than addressed through the use of commercial, off-the-shelf 
products. 

As it proceeds with the Loan Monitoring System, SBA will also 
need to continue strengthening its project management processes 
and controls. It has started to implement these basic policies and 
processes, and they are really critical for such an effort as the Loan 
Monitoring System. For example, instituting capabilities such as 
project tracking and oversight are essential to be able to monitor 
actual results and performance against the schedule. In addition, 
implementing configuration management policies, which are a set 
of controls over changes to computer and network system changes, 
are important to successfully managing systems that intend to be 
as complex as the Loan Monitoring System. Further instituting 
quality assurance activities, to verify that system development 
complies with applicable standards, provides SBA’s management 
with the information they need on whether the project is adhering 
to established standards and procedures. 

Another key aspect that must be addressed is security and pri- 
vacy of automated information. SBA’s planned reliance on the 
Internet poses security challenges that must be addressed early in 
the project’s life. Because of this, SBA needs to update its security 
operating procedures before it begins wide-scale development of the 
Loan Monitoring System. 

That concludes the summary of my statement, and I’d be pleased 
to address any questions you may have. 

Thank you. 

[Mr. Willemssen’s statement may be found in appendix.] 

Chairman Bartlett. Thank you very much for your succinct and 
informative testimony. 

Let me turn now to our Ranking Member and ask Mr. Davis for 
his questions and comments. 

Mr. Davis. Well, thank you. Thank you very much, Mr. Chair- 
man. 

Let me just indicate that I find this kind of testimony, especially 
the technical complexity of it, very intriguing. 

Mr. Hochberg, I know that many lenders use credit scoring when 
they are processing small loans. My understanding is that credit 
scoring may not work well with small and new businesses. 

I also noticed that you mentioned credit scoring and credit wor- 
thiness in your testimony. Can you indicate how you will use this 
information to assist start-up businesses, small businesses, real 
small businesses? 

Mr. Hochberg. Thank you. 

I think credit scoring is not really going to be applicable for very 
small businesses and start-up businesses. It looks at past payment 
history. However, we can use credit scoring on some of the more 
established businesses, where right now we have two separate fi- 
nancial analysts who review some of these loans. It will replace one 
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of them, so that we can use those resources better, perhaps, to 
work on more complex or trickier loans. 

But, credit scoring is just one tool that we’ll he using, one tool 
that we’ll he importing from the outside, not reinventing, but use 
as an outside resource, an off-the-shelf program that we’ll cus- 
tomize in some ways. 

Mr. Davis. You really wouldn’t have to have any fear that there 
is any possibility that this process or this mechanism could be used 
to redline. I’m always fearful of redlining, in terms of having gone 
through those experiences and having seen how sometimes the es- 
tablishment of standards and criteria will box some people out be- 
cause they just, for a number of reasons, may not be there. 

Mr. Hochberg. I think that with this Loan Monitoring System 
we will have better information on which banks are making loans, 
where they are making the loans, and the kind of businesses they 
are financing. So, in some ways I believe the opposite will happen, 
we’ll have far better data to understand where the gaps exist, so 
that we can better address those gaps. And, if we find in certain 
districts or neighborhoods that there is lower lending activity, 
which we’ll have a better handle on, we can go out and recruit 
other banks and other lending institutions to make sure that access 
to capital is not part of the problem. 

Mr. Davis. In his testimony, Mr. Wilkinson mentioned a desire 
or the desirability of SBA being a bit more specific in terms of spec- 
ifications for compliance. How would you respond? 

Mr. Hochberg. I’m not sure I fully understand that question. 

Mr. Davis. Well, I think he, could you mention that again? 

Mr. Wilkinson. I’m not sure I understand the question either. 

What I said was, we were looking for a set of specifications that 
they expect to publish soon, so that our lenders will know exactly 
what data file elements the SBA is looking for, so that we can then 
sit down with our computer folks to see what we have to do to com- 
ply- 

Mr. Davis. That is exactly my question. Is that forthcoming? 

Mr. Hochberg. We will be putting out the performance stand- 
ards and how we will evaluate and analyze different lender per- 
formance, so that banks will know precisely what are the criteria 
in terms of their PLP status and how they operate with the SBA. 
That will be much more explicit than it’s been in the past. 

Mr. Davis. Also, Mr. Willemssen mentioned in his testimony 
some question in relationship to custom development of data qual- 
ity, in terms of whether or not there can be a boilerplate, I would 
assume, set of data as opposed to having to customize for so many 
different entities and, perhaps, at different times. How would you 
respond to that question? 

Mr. Hochberg. It is our desire to use as much off-the-shelf soft- 
ware as we possibly can in each phase of the program, because this 
is a large system that has a lot of components to it. We mentioned 
credit scoring. We’ll be using D&B or a similar company in terms 
of getting credit analysis, b^ut we will be, as much as possible, 
using off-the-shelf systems because they are, frankly, less expen- 
sive. 

What we did find, though, up to this point, is that we found 
fewer parallels, fewer exact matches in the private sector or in 
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other government agencies than we, perhaps, had thought at first. 
So, we probably will rely a little bit more on customization than, 
perhaps, we would desire, but we don’t have a choice in this mat- 
ter. 

Mr. Davis. Thank you. 

Mr. Willemssen, I thought that you were quite complimentary to 
the SBA, in terms of progress that it has made towards compliance. 
Are there any areas beyond what you have discussed where you 
think there is a need or that they could make more progress or 
more effort? 

Mr. Willemssen. I think. Ranking Member Davis, I tried to 
summarize those pretty well in the opening statement, and what 
we’ve seen on the part of the Deputy Administrator and his staff 
is a real willingness over the last few months to work with us. 
They have been very responsive to the issues we’ve raised. 

We do have some remaining issues that we would like them to 
pursue. I’m not aware that they disagree with the need to imple- 
ment those actions. There may be a slight disagreement on what 
that means in terms of the roll-out of the eventual system, but 
we’ll continue to work with them to help ensure the project’s suc- 
cess and reduce the risks as much as possible. 

Mr. Davis. Thank you. 

Mr. Wilkinson, you, likewise, were quite complimentary, and I 
think we always like to see various partners being able to work co- 
operatively and work well, because that generally means there’s 
going to be a different level of success. 

Are there any other areas that you’d like to see some additional 
effort or additional movement in? 

Mr. Wilkinson. Well, as I said in my testimony, one of the key 
areas that we want to watch is the development of performance 
standards, and once we’ve figured out, okay, what do we have to 
submit up front on a loan application to comply, we’ve now col- 
lected certain amounts of data, well now, what are we going to do 
with that data, and how is the lender going to be graded, if you 
will. And so, we are looking forward to working with the agency on 
developing those standards over the coming months. 

And, the only other comment I would have is, the agency is hard 
at work at this. They have dedicated some serious resources to get- 
ting this done. Iteration One is scheduled to be finished by summer 
of 2000. My only concern is that if, for whatever reason, that 
doesn’t get finished by the summer of 2000 and we slide, we’d move 
into a presidential election, a change of administration, changes in 
leadership at the agency, that the project could get bogged down. 

So, we in the lending community are hopeful that while the ball 
is rolling that this project does get finished, at least Iteration one, 
this summer, because they’ve got a lot of folks working on it right 
now. 

Mr. Davis. Perhaps, this is my last question, Mr. Chairman. 

Mr. Hochberg, you heard that question. It’s also a thought that 
I’ve had, in terms of sometimes if administrations change, and 
when they do, certain policies within agencies sometimes will also 
change. As a person inside the agency, can you give us any assur- 
ance, while you can’t ever give absolute assurances, but can you 
help belay any concerns that we might have in relationship to that. 



14 


relative to what’s being instituted internally to make sure that 
there is a continuation? 

Mr. Hochberg. One, I just want to add, I think we’ve been work- 
ing hard and have a very good relationship with the General Ac- 
counting Office and NAGGL, so, one, our outside partners, that is 
not going to change, and that is a steady factor. 

Additionally, the team that is sitting behind me, our Chief Oper- 
ating Officer is a career person, and our Chief Financial Officer is 
a career person. Larry Barrett is our Chief Information Officer, ca- 
reer person. They will be here regardless of a change in adminis- 
trations. But, I do think that Tony mentioned one important thing. 
The best way to ensure that there is less interruption is for us to 
get moving and start implementing, to get this project underway. 

The concern always is with a change of administrations that 
when things are simply in draft form or planning form, there’s a 
good reason to reevaluate everything, but if we are making 
progress, as Tony mentioned, having Iteration one installed, work- 
ing it through, we will learn so much by installing that first 
iteration that will inform the rest of the process. I think that’s the 
best assurance that we keep this thing moving and moving rapidly. 

Mr. Davis. It seems to me that progress is, indeed, being made, 
and so I want to compliment you on, not only the effort, but what 
appears to be a great working relationship, and certainly it seems 
to me that you are moving positively towards implementation. 

Mr. Chairman, I don’t have any other questions. I thank you 
very much. 

Chairman Bartlett. Thank you very much. 

We’ll turn now to Mr. Toomey. 

Mr. Toomey. Thank you, Mr. Chairman. 

Just a couple of quick questions. Mr. Hochberg, it’s my under- 
standing that this Loan Monitoring System has been designed with 
the 7(a) program in mind. Could you just comment whether there’s 
any applicability at all to the other loan programs, or where that 
stands? 

Mr. Hochberg. Yes. This loan program was designed initially 
with the 7(a) program in mind. It does include the 504 program. 
It includes microloans and those loans are really made to inter- 
mediaries. In addition we did some disaster planning models in 
modules for our disaster loan, which is a direct loan program. So, 
we did some front-end work to make sure that this system will en- 
compass the full range of lending that we do. 

Mr. Toomey. Okay. 

And, I think it was Mr. Willemssen who suggested that one of 
the areas that continue to need development, if I understood cor- 
rectly, was to ensure that the system is fully integrated with the 
MIS agency-wide, and could you just comment on that, how you see 
that proceeding? 

Mr. Hochberg. Let me emphasize, we know this is a large 
project for the SBA. This is a big systems development effort, larg- 
er than we have tackled before, which is why it has been such a 
deliberate process, why we’ve gone through the eight steps, why 
we’ve worked so closely with GAO, with our outside partners, and 
have brought in a number of consultants and contractors. 
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But, the architecture has been developed. We are waiting for the 
final draft of that to come back from our contractor to review. That 
is an essential platform that has to be in place before we go fur- 
ther. 

So, we are fully in agreement on that. 

Mr. Toomey. And, last question, when all is said and done and 
this is finished, what do you think the total cost will have been? 

Mr. Hochberg. Well, I think the total cost we currently are esti- 
mating at $27.7 million, will be the total cost for phase one of this 
system. That is for the Loan Monitoring System. That does not in- 
clude the overhaul of our financial systems, which we have just 
begun, including our human resources as well as contracting pro- 
grams, and some of the other technical assistance programs. So, I 
should just add that’s the cost estimate only for phase one. 

Mr. Toomey. Okay, thank you. 

Mr. Hochberg. And, that is an estimate. 

Mr. Toomey. Okay, thank you. 

Chairman Bartlett. Thank you very much. 

Let me ask a technical question or clarification first. I wonder if 
you could put back up the chart which is entitled, “Doing More 
With Less.” You said in your oral testimony that you were now 
doing more with less, and that you were now using 22 percent less 
employees in the last decade. 

If I look at the chart, it would appear that in the last decade 
your number of employees has dropped to about 50 percent. I was 
just wondering, was your oral statement wrong or is the chart 
drawn incorrectly? 

Mr. Hochberg. Our total employees are down. The problem with 
the chart is we should have a scale on the left side to show total 
number of employees. 

Chairman Bartlett. I’m presuming the scale was linear, no 
matter what the scale is, if it’s linear why it would appear that in 
the last decade it’s dropped almost 50 percent. Has it not? 

Mr. Hochberg. Let me just get a clarification. The staff in 1992 
was 3,874 employees. In 1999, we are looking at 3,123 employees, 
which is a reduction of 751 to be precise, so that would be the exact 
number. 

Chairman Bartlett. Okay. So then, the chart is drawn incor- 
rectly. 

Mr. Hochberg. Probably the scale is off. The staff part of the 
chart appears to be on the high side. 

Chairman Bartlett. Okay, thank you very much. The two just 
didn’t jibe, and I wanted to make sure why. 

Mr. Wilkinson, you mentioned that the default rates were too 
high, which means a lot of monies have accumulated because they 
were not needed to cover those default loans. One of two things 
presumably could happen as a result of that. One is that less mon- 
ies could be appropriated because monies have built up. Is there a 
second alternative, and that is that we now could make more loans 
because we have the monies there? 

Mr. Wilkinson. No, sir, that money automatically goes to Treas- 
ury. It is gone. There is the agency cannot use those funds. 

Under the Federal Credit Reform Act, the agency must estimate 
what the net present value cost of their program is, and that is 
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done based on entering the future cash flows, how much fees we 
are going to charge borrowers and lenders to be involved in the 
program, so all the fees are set up front. As time passes and we 
get actual numbers, the actual numbers replace the estimated 
numbers, and there’s a reestimate amount, either positive or nega- 
tive, that either flows to Treasury or is borrowed from Treasury. 
Borrowed is the wrong word, or received from Treasury, to settle 
up the account. 

But, what has happened over the last several years is, there’s al- 
ways been too much money estimated up front, so that the amount 
of appropriations, fees charged to borrowers and fees charged to 
lenders, has been more than has been necessary. But, under the 
Federal Credit Reform Act, those monies flow straight to Treasury 
and they are gone. 

Chairman Bartlett. I thought I heard you say in your testi- 
mony that enough monies had accumulated that we wouldn’t need 
any appropriations for the next year. 

Mr. Wilkinson. No, well I was trying to draw the comparison of 
how much had been overestimated, how much the cost of the pro- 
gram had been overestimated, in relation to what we had to obtain 
in appropriations for the Fiscal Year 2001 budget. 

Chairman Bartlett. Okay, but there are no monies that are 
available to you, because at the end of the year they simply return 
to Treasury. 

Mr. Wilkinson. That is correct. 

Chairman Bartlett. So, we need to take cognizance of that in 
future appropriations, so that surplus monies don’t need to be ap- 
propriated, is what you are saying, because they can’t be used and 
simply go back to Treasury. 

Mr. Wilkinson. Well, each year we must get an appropriation to 
fund a certain program level, and what we are saying is that the 
estimates used in that are too high. We still have to have those ap- 
propriations, because once 0MB sets the subsidy rate number it is 
set, and we have to live with that. So, the Fiscal Year 2001 subsidy 
rate is set, and for us to have sufficient monies to loan to small 
business we must obtain the appropriation. 

Where we need to focus is more on the Federal Credit Reform 
Act and the kinds of estimates that 0MB is allowed to use in the 
model. 

Chairman Bartlett. Thank you very much. 

The purpose of our hearing today, of course, was to determine 
the status of planning or implementation of this Loan Monitoring 
System. Mr. Hochberg, in your oral testimony you said that we 
were now ready to go forward. I gather from subsequent remarks 
you made that you feel that you are now ready to implement the 
system. 

The monies, of course, as a result of Section 233 of the Small 
Business Reauthorization Act of 1997 Act, have been fenced, and 
they will not be released from the appropriators until a signal from 
our committee, and that signal will not be made until we get a sig- 
nal from GAO that you, in fact, have completed those eight plan- 
ning steps that were mandated by that Act. 

Mr. Willemssen, in his testimony, and his summary, went 
through and I think I numbered them correctly, a dozen items that 
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in his view need to be completed. I am presuming, Mr. Willemssen, 
that your position is that these actions need to be completed before 
you can certify that these eight planning steps have been com- 
pleted, so that the system can now be procured. 

Mr. Willemssen. The majority of those actions we would want 
to see completed before SBA embarks on major design and develop- 
ment activities associated with the Loan Monitoring System. To the 
extent, and this is the subject of some discussion that we’ve had 
with SBA over the last day or two, to the extent that their 
Iteration One is viewed as more of a prototyping effort and some- 
thing that helps them learn more about what they want the system 
to do, then I would reduce that list to a much smaller number. 

We have received some information from SBA on exactly what 
that first iteration associated with the system is, but not enough 
yet to make a final determination. 

Chairman Bartlett. Thank you. 

Let me go through the list, if I might, and just ask each of you 
your position on it, and then I would like to get an estimate of time 
to complete. It’s my understanding that there are more than ade- 
quate monies there to complete the planning? 

Mr. Willemssen. Correct. 

Chairman Bartlett. Okay. 

Number one was, completing the analysis of benefits and costs 
for alternative business processes identified through SBA’s busi- 
ness reengineering effort. This is a task that needs to be completed, 
in your judgment, Mr. Willemssen, before we can certify the system 
as ready to be implemented? 

Mr. Willemssen. Yes. We would like to see additional informa- 
tion on costs and benefits associated with a range of alternatives 
for going forward with the major system development activity. 

Chairman Bartlett. Mr. Hochberg, do you understand what 
GAO is interested in here, and do you agree? 

Mr. Hochberg. My understanding in working with Joel, is that 
what is needed is a more explicit articulation of what the cost bene- 
fits are program by program, not the total system, but by elements 
of the program. That’s my understanding. But, associated with 
what options that the agency will pursue is making sure that those 
are the most cost effective options, so that we are getting a system 
that meets everyone’s needs at the lowest possible cost. 

Chairman Bartlett. And, how long should it take for that to be 
implemented? Your guess, Mr. Willemssen, and then I’ll ask Mr. 
Hochberg his. 

Mr. Willemssen. I would say it would still take a couple months 
more work on the part of SBA to do that. 

Chairman Bartlett. Any argument with that, Mr. Hochberg? 

Mr. Hochberg. I probably should ask Larry Barrett, our Chief 
Information Officer, to give a more precise estimate of that kind of 
information. 

Mr. Barrett. Larry Barrett, Chief Information Officer, Small 
Business Administration. 

I estimate it slightly shorter than that. We are estimating some- 
where from four to six weeks to accomplish those tasks. 

Chairman Bartlett. Thank you very much. 
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The second one I have identified here is performing benefit cost 
analysis for systems alternatives. 

Mr. WiLLEMSSEN. Correct, and that can actually be associated 
with the item that we just talked about. As SBA goes through the 
business and system alternatives, it should determine the costs and 
the benefits of each. 

Chairman Bartlett. So, if they completed the first project that 
we talked about, they would have to finish the second 

Mr. WiLLEMSSEN. The two should be done in concert. 

Chairman Bartlett. Okay, so the two months, or the four to six 
weeks estimate on the part of the agency, should accomplish both 
of those first two. All right. Thank you very much. 

The third one I have identified here is completing the part of its 
information architecture that specifies the rules and standards for 
interoperability and maintainability of interrelated systems. 

Mr. Willemssen. 

Mr. Willemssen. If SBA puts the necessary resources to that 
task, there’s no reason that they can’t have an initial identification 
of the standards and protocols they want to adhere to in a matter 
of several weeks. It’s just a matter of putting the resources on it. 

Chairman Bartlett. Mr. Hochberg, you have the resources to 
get this done, and do you agree with several weeks? 

Mr. Hochberg. Let me just add, Mr. Chairman, that the money 
you mentioned, the $8 million that was appropriated for 2000 that 
is fenced off, some of this project can be done by internal staff that 
is dedicated to this project. However, the funds to pay that staff are 
actually in that $8 million appropriation. The only money we have 
is fenced off, parked at FEDSIM to be used for outside contractors. 
But the money needed to have our internal staff keeping doing this 
work and doing it more thoroughly, we do not have access to those 
funds. 

Chairman Bartlett. Mr. Willemssen, from your testimony it 
was my understanding that adequate monies were there, do you 
understand that some of those monies are fenced so that they are 
not available, and who needs to take action to make sure they are 
not fenced so that they can complete the planning? 

Mr. Willemssen. Well, our view of the monies available, it’s a 
matter of whether SBA wants to decide to use in-house resources 
or contractor resources to get some of these activities accomplished, 
and then laying out a clear schedule of activities for who is going 
to do what and when. 

It would certainly appear to us, based on the information we 
have at this point in time, that adequate funds are available for 
those planning activities. If SBA or the Deputy Administrator has 
information to the contrary we’d be more than happy to look at 
that. 

Chairman Bartlett. But, the information you now have avail- 
able, you would indicate that probably there should be enough 
monies there to complete the planning? 

Mr. Willemssen. Yes, sir, Mr. Chairman. 

Chairman Bartlett. And, they are not fenced and we do not 
have to take action to release them? 

Mr. Willemssen. I do not have evidence of that for the planning 
side. 
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Chairman Bartlett. Mr. Hochberg, if that is true, if monies 
which you need are fenced and some action needs to be taken to 
release them, would you please indicate what is fenced and what 
actions need to be taken, so that your progress will not be slowed 
due to lack of available monies? 

The fourth one was identifying requirements and data elements 
for reports. 

Mr. Willemssen. 

Mr. Willemssen. SBA has made progress on this and is getting 
close to having a standard set of data elements. I think it was dis- 
cussed somewhat in the testimony earlier that the lenders want to 
have this information too. SBA just needs a little bit more on the 
input and output side on the level of detail, but I think they are 
getting fairly close on that. 

Chairman Bartlett. What is close in terms of time to complete? 

Mr. Willemssen. I would say, again, within a period of several 
weeks. 

Chairman Bartlett. Several weeks? 

Mr. Hochberg. 

Mr. Hochberg. Mr. Chairman, generally GAO is conservative, so 
if they say several weeks I’m comfortable with that estimate. 

Chairman Bartlett. Okay, thank you. 

Let me ask a question, when you are saying several weeks, and 
four to six weeks, and two months and so forth, are you presuming, 
are both of you presuming that there are adequate resources there 
that these times can run concurrently, or they have to run sequen- 
tially? 

Mr. Willemssen. No, many of these activities can run concur- 
rently, and that’s why I would echo the comment I made earlier, 
it’s a matter of SBA putting the needed resources on these activi- 
ties to get them done in that time frame. 

Chairman Bartlett. When we finish this list, we’ll go back 
again and ask you to look at the longest one of these and ask the 
question, are there enough resources to complete them all within 
that time period, or do some of these have to be sequential, simply 
because maybe some of them can’t be done until others are done, 
or because the same people are needed to do two of them. You can’t 
do two things at once. 

Mr. Willemssen. Right. 

Chairman Bartlett. So, we would like to come away with a feel- 
ing as to the maximum amount of time it’s going to take in addi- 
tion to the amount of time it’s going to take for each of these com- 
ponents. 

Five, completing the definition of specific data, quality standards, 
did we cover that one? 

Mr. Willemssen. Yes, among the items we’d like to see there is 
more specificity on SBA plans to clean up the data before embark- 
ing on major software design efforts. 

Again, depending on how Iteration One is defined, something like 
this can possibly be delayed. The data quality standards are abso- 
lutely essential eventually but not as pivotal in terms of finishing 
them before proceeding. 
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Chairman Bartlett. In other words, you are saying that you 
could certify to us that they were ready to buy equipment before 
this was necessarily completed? 

Mr. WiLLEMSSEN. Right, there would be other activities that 
would be higher on the priority list to address. Data quality must 
be addressed, it’s absolutely essential. But in terms of doing this 
before proceeding with the initial system design. I’m not as con- 
cerned. 

Chairman Bartlett. With an adequate understanding between 
GAO and the agency, you then could certify to us that they were 
ready to procure if you had a good feeling about how they were 
going to address this? 

Mr. WiLLEMSSEN. Right, and we saw the specific milestones that 
SBA officials have laid out for when they are going to do this and 
how, and then they have the project management oversight to 
track what actually happens against that schedule. 

Chairman Bartlett. Okay, thank you. 

Number six, ensuring that systems requirements document in- 
clude capacity and performance requirements. 

Mr. WiLLEMSSEN. This is possibly the one of the eight that would 
take the longest, in my opinion, especially if Iteration One is the 
beginning point of a typical system design and development effort. 

Among the things that SBA needs to still look at here are speci- 
fying exactly what they want the system to do from a capacity per- 
spective and a performance perspective. For example, how big is 
this going to be? How many lenders are going to be accessing it? 
How many employees and, therefore, how much horsepower do we 
need, how much communication throughput do we need? What 
kind of performance are we expecting? Are we expecting immediate 
on-line access 24 hours a day? That has ramifications for the size 
of the system, which has ramifications for the cost. 

So, there are still some issues here that SBA needs to look at. 
Again, I want to reemphasize, to the extent that Iteration One is 
more of a prototyping effort, where SBA tries to learn more about 
what they want the system to build, then we’re less concerned with 
making sure this is fully done before they proceed. 

Chairman Bartlett. But, if you don’t know the system’s capac- 
ity needed and the performance requirements, how can you size the 
system? 

Mr. WiLLEMSSEN. Well, you can’t from a traditional life cycle ap- 
proach to system development. Again, and that’s why if they want- 
ed to take an initial prototyping effort to get some more indication 
and validation of where they think they are going is correct, then 
that’s a more appropriate strategy. But, starting on a major system 
design and development effort with not knowing those exact speci- 
fications on capacity and performance, that’s a little more risky. 

Chairman Bartlett. I’m familiar with prototyping in the de- 
fense area, where you acquire a prototype system and you gain ex- 
perience with it. You now know what you need to change so that 
the next one will be better, that’s not what we are talking about 
here. You are not talking about a prototype system that they are 
going to get some experience on and then discard and buy the real 
thing? 
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Mr. WiLLEMSSEN. I don’t have the full description of the system 
at this point, for example, a statement of work on exactly what 
would be involved right now in SB A Iteration One. I’d defer to the 
Deputy Administrator, but I know SBA is considering looking at 
testing some different scenarios, some different prototype systems, 
to see that the requirements that they’ve laid out to date are rea- 
sonable. 

Chairman Bartlett. Am I also correct in assuming that this 
cannot be done until some of the other things are done, because 
you will have to have completed some of the others before you 
could get an estimate of the capacity needed and the performance 
requirements, would you not? 

Mr. WiLLEMSSEN. That is correct. 

Chairman Bartlett. So, this will be sequential. 

Mr. WiLLEMSSEN. That one is, from a couple perspectives, a bit 
more sequential, and, again, is the one that probably holds SBA up 
the longest. 

Chairman Bartlett. Now, once they are able to start with that, 
have the information necessary to start, how long will it take to 
complete it in your judgment? 

Mr. WiLLEMSSEN. To complete Iteration one? 

Chairman Bartlett. No, to complete ensuring systems require- 
ments document, include capacity and performance requirements. 
You can’t do that until some of the other things are done. Once the 
other things are done, how long will it take to do this one? 

Mr. WiLLEMSSEN. I would say my best estimate would be early 
summer 2000, to have it all done, from a system requirements 
standpoint. 

Chairman Bartlett. Okay, so you are talking about four 
months. 

Mr. WiLLEMSSEN. And again, those time frames are driven based 
on the point that you made a few minutes earlier. We have to look 
at where the resources are, and does SBA have available resources 
from a contractor and in-house perspective. And my other caveat 
is, as the Deputy Administrator mentioned earlier, dependent upon 
the approach they want to take with Iteration One. 

Chairman Bartlett. Okay. 

Mr. Hochberg, do you agree with this estimate? 

Mr. Hochberg. Let me respond to that. I’d also like Larry to re- 
spond, since it is his direct responsibility to do this implementa- 
tion. 

I should add for a point of clarification that I will also follow up 
in writing, the funds for 2000, to pay for staff to do this work, be- 
cause this is a blend of both contractors and staff, are held by 
Chairman Rogers’ Appropriations subcommittee. We cannot use 
those funds, to pay internal costs to do this work until that money 
is released. 

The money we have access to at the moment is at FEDSIM, 
which can only be used for outside consultants and outside contrac- 
tors. None of that can be used to pay the people that at the direc- 
tion of the committee we have brought in house to ensure con- 
tinuity in the planning process. Therefore, we are using regular 
salaries and expense funds — not modernization funds — until we get 
that release from Chairman Rogers. 
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But, let me ask Larry to respond to the timing issue. 

Mr. Barrett. Larry Barrett, CIO. 

We disagree with GAO’s estimates. We think that we can do it 
probably in a slightly shorter period of time for two reasons. The 
first reason being that we think that we have collected a lot of that 
information already, although we haven’t provided it to GAO yet, 
and the second reason is that we view Iteration One as a prototype, 
and we need that prototype or we need that first iteration to pro- 
vide additional information for us to do the capacity planning for 
the full-blown system that will come later. 

Chairman Bartlett. Okay. 

Let me ask Mr. Wilkinson, I gather that you have not yet deter- 
mined whether prototype equipment needs to be acquired and work 
lists before completing final system design. At what point will you 
be comfortable with whether or not that needs to be done, so that 
the monies necessary for that. I’m gathering that the monies nec- 
essary for acquiring the prototype are fenced, and they would need 
to be released, and that will require your agreement and the agree- 
ment of this committee and the Appropriations Committee before 
that’s released? 

Mr. Wilkinson. I would be more comfortable with Iteration One 
when I saw a document such as the statement of work, for what 
the contractor is exactly supposed to do for that particular 
iteration, and we have evaluated that, discussed it with SBA, and 
made some determination as to the adequacy of that approach. 

Chairman Bartlett. Okay. So you need proper documentation 

Mr. Wilkinson. And, I have not seen that to date. 

Chairman Bartlett. So, that needs to be done before you can 
reach a considered judgment. 

Mr. Wilkinson. And, the SBA may have it done, we have not yet 
been provided that document. 

Chairman Bartlett. You’ve just not seen it yet. Okay. 

Now, the seventh one was ensuring that sound justification ex- 
ists for pursuing custom development functions. I gather that GAO 
has a concern that not enough COTs, commercial off the shelf, is 
being planned, and that the agency is considering pursuing some 
custom developments that may not be necessary in your judgment? 

Mr. Wilkinson. Well, the Deputy Administrator has discussed 
this point, the fact that they will, to the extent possible, try to pur- 
sue commercial off-the-shelf products. We think that’s the right ap- 
proach, because generally speaking you can get those done quicker 
and at less cost. 

It was a bit surprising to us to see that about 40 percent of the 
functions needed non-COTs products, and we just wanted to see 
the written justification and rationale for why it was that high. So, 
it’s not to say we don’t believe SBA, we would just like to see what 
documents support that, given that that kind of approach generally 
results in higher costs and lengthier time frames. 

Chairman Bartlett. Okay. 

Mr. Hochberg, does the agency have the justification for the cus- 
tom developments, rather than going commercial off the shelf? 

Mr. Hochberg. Mr. Chairman, we are looking at that. There are 
many parts of the Loan Monitoring System. So on a system-by-sys- 
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tern basis we are looking at commercial off the shelf versus in- 
house programming across the board. 

I come from the private sector. I ran a business for 18 years. The 
last thing I would want to see done is reinventing the wheel, devel- 
oping things that can be found on the outside. I have zero interest 
in that whatsoever. 

I agree with Joel entirely, it takes longer, it costs more money 
to do a custom solution. So, to the extent possible we want to find 
off-the-shelf programming in the same way we want to centralize 
as many processes as possible. 

Chairman Bartlett. When will you have completed that anal- 
ysis, to be able to get that information to GAO? 

Mr. Hochberg. I should ask Larry to give you the precise timing 
on that. 

Mr. Barrett. The COTs decision will be an ongoing evaluation 
as we go through the various iterations of the system. We will con- 
stantly be looking to see if we can purchase off-the-shelf software. 
We’ll make a decision on Iteration One before we proceed in 
Iteration One, and then use that information in terms of deciding 
about the software for the succeeding iterations as we go through 
them. 

Chairman Bartlett. Thank you. 

Mr. Willemssen, the eighth item I have here is estimating the 
cost to completion that are based on an analysis of the benefits and 
costs of system alternatives. Do I conclude from this that you aren’t 
sure that the, what, $27 million is the right amount? 

Mr. Willemssen. Yes, in terms of SBA’s effort on this particular 
action, it is substantially completed at this point. However, when 
they embark on additional analyses and costs and benefits of alter- 
natives, that figure could change, and so they will have to refine 
the figure after the cost benefit analysis. And, we also think it’s im- 
portant for SBA to look at the Loan Monitoring System from a life 
cycle perspective. That’s what’s typically done on major information 
systems, is you don’t only look at the design and development costs, 
but the operation and maintenance costs down the line, and the an- 
ticipated life of the system. 

Chairman Bartlett. Thank you. 

You have also identified four areas in the project management 
area where SBA should strengthen its project management process 
and control, and I just wanted to go through those briefly to see 
how much time that was going to take, and would their ability to 
do these things impact the final schedule. 

The first of these was to include putting in place project tracking 
and oversight capabilities. 

Mr. Willemssen. Yes, project tracking and oversight are very 
important for a major effort like this. In the grand scheme of infor- 
mation technology government-wide this is not such a huge effort, 
but for SBA it is. It’s the biggest one they’ve ever undertaken. 

The reason that these four are a little different than the other 
eight, is they transcend boundaries. These have more to do with 
key processes and controls that SBA needs to implement agency- 
wide. This is not something that like the eight actions before that 
we can point to and say, do it for this project. It’s something that 
has to be implemented more from an agency-wide perspective. It’s 
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almost cultural, that when we have a major system effort like this, 
we are going to have project tracking and oversight activities. 

On all of these, not just project tracking and oversight, SBA is 
committed to the changes. But it does take time, and it’s not some- 
thing that you can say will he done at a certain point in time. They 
have to continue strengthening those processes. 

Chairman Bartlett. Was it your presumption that they would 
have done these four things when you gave us the time estimates 
for completing the first eight? 

Mr. WiLLEMSSEN. It was our belief that these would be in the 
process of being implemented, but not fully mature. Fully mature 
information technology processes take a long time to implement, 
and most of the federal agencies are not there yet. 

To the extent that those processes and controls become more ma- 
ture, you’ve reduced the risk of systems that don’t work as you ex- 
pected, and you reduce the risk that they go over budget. This is 
more of a agency-wide scope, it’s a little bit broader than just the 
Loan Monitoring System. It’s the way information technology 
should be done, not only the federal government, but all major or- 
ganizations. This is followed predominantly on a model initially de- 
veloped by the Software Engineering Institute out of Carnegie-Mel- 
lon. 

Chairman Bartlett. Thank you. 

Mr. Hochberg, let me read these four to see if you agree that 
these are things that need doing and that you are doing, and that 
it’s your judgment that you are working with GAO to accomplish 
these goals. The first was putting in place project tracking and 
oversight capabilities. The second was implementing configuration 
management processes. The third was acquiring independent 
verification and validation for the Loan Monitoring System project 
and establishing an internal quality assurance function, and the 
fourth was addressing the security challenge posed by internet- 
based access to Loan Monitoring System functions and data. 

Mr. Hochberg. Mr. Chairman, it is my understanding and my 
sense, as the Deputy Administrator, I am not the Chief Information 
Officer, that all four of those are in place. I can particularly speak 
to two, and I can let Larry fill in some details. 

On the independent validation and verification, again, coming 
from the private sector, again, looking at how other agencies have 
tackled major systems projects, I wanted that IV & V to make sure 
that we don’t stumble in the way that some other organizations 
have stumbled. 

In terms of security, this was a material weakness that was cited 
in the 1998 audit of the agency. The Administrator put into place, 
upon receiving that audit, immediate plans to upgrade the security 
of computer data, as well as internet security. We’ve brought in a 
contractor, and added a number of staff to specifically address that 
item. 

The other two I’m going to let Larry address, and certainly he 
may want to add to what I’ve just said. 

Mr. Barrett. As was indicated, this is going to be an ongoing ef- 
fort, but we have taken significant steps, I think, to address project 
tracking and configuration management. 
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A couple of things that we are doing is that we have provided 
our staff, internal staff, with formal training in both project man- 
agement and configuration management, and we have been given 
the authority to hire additional people. One of the requirements 
and one of the things that we are looking for when we bring in new 
staff members is for people to bring in people with experience in 
these basic areas, so not only will we have people already on staff, 
but bringing in new people. In the interim what we are doing is 
hiring contractor support to mitigate any weaknesses that we have 
in both the project tracking area, as well as configuration manage- 
ment and quality assurance. 

As the Deputy Administrator indicated, we have a big effort un- 
derway in terms of Internet security, and just security in general 
within the agency. We started that over six months ago. The Ad- 
ministrator made a major commitment in terms of both resources 
and dollars to enhance our programming, and that’s well under 
way. 

Chairman Bartlett. Thank you very much. 

I want to thank the witnesses very much for their testimony. 
This is a necessary oversight responsibility of the Congress. We are 
pleased with the progress that SBA has made in the roughly year 
and a half since our first hearing. We are pleased that SBA and 
GAO are working together. We are pleased that there is a general 
meeting of the minds as to what yet needs to be done and how long 
it will take to do that, and I promised that we would come back 
to look at an overall time. 

If things go reasonably well, Mr. Willemssen, you are saying it 
will be early-mid summer before we would be in a position to pro- 
ceed with procurement? 

Mr. Willemssen. The caveat I would have is based on a com- 
ment that Larry made. If the agency does have additional docu- 
mentation associated with system requirements that we haven’t 
seen, that substantially address the issues we’ve laid out, then I 
would up my estimate further, but I haven’t seen those documents. 

Chairman Bartlett. So, with what you’ve seen you are saying 
it’s mid-summer? 

Mr. Willemssen. Then I’d say early summer. 

Chairman Bartlett. Early-mid summer. 

Mr. Hochberg, that’s reasonable? 

Mr. Hochberg. It’s reasonable to me. 

Chairman Bartlett. Mr. Hochberg is nodding in the affirmative 
that it’s reasonable. 

Well, let me thank you very much, and if you need some action 
to release funds, GAO is not sure that those funds need to be re- 
leased. Our staff is not sure they need to be released, but if in the 
judgment of the agency you do not have adequate funds and you 
need funds released, please substantiate that, document that, and 
get it to us, and also to GAO so that if there are necessary steps 
to be taken they can be taken, because we would like the control 
of these lending programs to be moved from the agency to the pri- 
vate sector. That cannot be finally accomplished and implemented 
until this is done, so we are anxious that it be done expeditiously. 
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Let me thank all of the witnesses very much for your testimony, 
and we will keep surveillance of this program and there may need 
to be an additional hearing before the funds are finally released. 
Thank you very much. 

Mr. Hochberg. Thank you, Mr. Chairman. 

Chairman Bartlett. The meeting is in adjournment. 

Mr. Wilkinson. Thank you. 

Mr. WiLLEMSSEN. Thank you. 

[Whereupon, at 11:29 p.m., the subcommittee was adjourned.] 
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Progress in Planning for Proposed 
7(a) Automated Loan Monitoring System 

Good morning and welcome to this hearing of the Subcommittee on 
Government Programs and Oversight of the Committee on Small Business. 
A special welcome to those who have come some distance to participate and 
to attend this hearing. 

Today we will examine a matter that is of great importance to the taxpayers 
who expect the 7(a) government guaranteed loan program to be well 
managed and remain solvent. The hearing is important to Congress in its 
oversight role and to the U.S. General Accounting Office which is 
responsible - through the audit function - to provide accurate information as 
to the financial condition of federal government programs. And this hearing 
should be of importance to the Small Business Administration - known here 
in Washington as “SBA” - the federal agency that is responsible for the day- 
to-day direction of the 7(a) loan program. 
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Section 233 of the Small Business Reauthorization Act of 1997 (Public Law 
105-135) requires that SBA complete eight mandated planning actions 
before the agency obligates or expends any funds for the development and 
implementation of the proposed new, automated 7(a) loan monitoring 
system. It would seem only a matter of common sense that the planning 
phase should be completed before an agency makes major software and 
hardware purchases for a new computer system. 

The proposed new automated loan monitoring system for the 7(a) loan 
program was the subject of a prior hearing of this Subcommittee held on 
July 16, 1998. We were encouraged by testimony at that hearing that the 
Small Business Administration had a project plan, but none of the eight 
planning steps had been completed. 

We in Congress support the Administrator’s initiative in relying more on 
the private sector in the 7(a) loan program. We support SBA’s turning over 
to hometown bankers the decision to originate loans and the responsibility 
for servicing and liquidating loans. Certainly the local banker has more 
knowledge of the lender and his or her credit worthiness than bureaucrats 
located some distance form the community in which the loan is made. 

Also, there is broad-based support in Congress for the Administrator’s 
efforts to modernize SBA’s systems and outlook. There is broad-based 
support for the Administrator’s goal for the 7(a) loan program - to get SBA 
out of the loan application approval business altogether and to the assume 
the role of overseer of the lending institutions. 

This hearing will focus on the progress SBA has made, since the July 16, 
1998 hearing, in performing and completing the planning needed to serve as 
the basis for funding the development and implementation of the 7(a) loan 
program computerized loan monitoring system including the eight planning 
steps required by the Act. 

At this hearing today, we would appreciate your assessment of (1) whether 
any planning has been completed as of today, (2) the management decisions 
made as a result of that planning, (3) the planning remaining to be 
completed, and (4) the management decisions remaining to be made. 
Further, we would like to know the extent to which SBA has involved the 
lenders in the planning process. Lastly, does the planning for the system 
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include maximizing opportunities to reduce needless paperwork, regulatory 
burden and costs borne by the borrowers, lenders and SBA? 

It would be unacceptable for SBA to ignore the law and the will of Congress 
expressed in Section 233 of the 1997 Small Business Reauthorization Act. It 
would be unacceptable for SBA to bypass accepted system development 
standards and essential planning steps. No successful business could omit 
prudent planning. It is incumbent upon Congress and the U.S. General 
Accounting Office to see that a federal agency does not engage in wasteful, 
willy-nilly project management. 

In a nutshell, the purpose of this hearing is to hold SBA’s feet to the fire to 
make sure they complete the eight planning steps required by law before the 
agency spends any taxpayers’ money to buy software or hardware for a new 
automated computer system for monitoring its 7(a) loan portfolio. 

Again thank you all for participating in this hearing. And thank you in the 
audience for attending this hearing. 
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Good morning, Mr. Chairman and Members of the Subcommittee. Thank you for 
inviting the U.S. Small Business Administration (SBA) to testify today about our planning for 
the implementation of our Loan Monitoring System (LMS). My name is Fred P. Hochberg and I 
am the Deputy Administrator at SBA. Joining me is Kris Marcy, the Chief Operating Officer, 
Lawrence E. Barrett, the Chief Information Officer, Charles Tansey, Associate Deputy 
-Administrator for Capital Access, and Joe Ixrddo, the Chief Financial Officer. We are appearing 
on behalf of SBA Administrator, Aida Alvarez, whose schedule does not permit her being with 
you today. 

Since we last testified on this topic in July 1998, SBA has made significant progress in 
leveraging our resources through the development of public-private sector lending partnerships 
and in designing our overall information technology systems. The Loan Monitoring System 
(LMS), however, remains the core of our modernization initiatives. 

By way of background, the Loan Monitoring System is Phase I of a tliree-phase, multi- 
year overall systems modernization program. This is the subject of today’s hearing. Phase II 
contains both the core accounting system and the disaster loan system. Phase II will allow us to 
produce timely financial statements and expedite the disbursement of disaster funds to people 
who need to start rebuilding their homes and businesses. Phase II is also critical to the LMS 
because the Agency must account for the loan portfolio in its financial statements and the LMS 
will service loans made in the disaster program. Phase III will modernize the systems used for 


the rest of the agency's programs. 
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We are truly excited by the benefits that this new technology will provide. Here is just a 

brief outline of some of the benefits that will be derived fi-om the system: 

For our lending partners: 

• SBA compatibility with our lending partners by enabling seamless reporting, exchange of 
data, and fee management. 

• Decreased risk of imprudent lending by a small group of lenders, thereby freeing resources 
for prudent lending partners. 

• Shorter turnaround times, better service, electronic fund transfers, and simplified data 
collection. 

For SBA: 

• SBA personnel will finally have the analytical tools and real-time access to information 
required for appropriate business decisions. 

• Electronic workflow will eliminate much of the paper, which will allow SBA personnel to 
focus on loan analysis, lender oversight and relationship management. 

• Electronic loan files will be accessible “on-line” with appropriate safeguards eliminating the 
costs and delays involved with transferring paper fi-om office to office. 

• More accurate data will make back-end functions such as asset sales due diligence and 
subsidy rate calculations less onerous. 
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I want to thank you Mr. Chairman and the Members of the Subcommittee for your past 
support of our efforts and I ask for your continued assistance and support in the future. 

SBA’s MISSION 

SBA provides capital to a unique niche in America’s commercial market. Simply put, 
our legislative mandate is to serve as a gap lender, to ensure that those small businesses who do 
not have access to traditional means of capital in the commercial marketplace are able to get the 
funds necessary to start or grow their business. 

FORCES CREATING IMMEDIATE NEED FOR MODERNIZATION OF THE SBA’S 
KEY PROCESSES AND TECHNOLOGY 

There are several important events which are forcing the Agency to prioritize the 
modernization of our core business and technology practices: 

1) Changes in governance and policy have led to an increased reliance on private sector 
lenders for delivery of SBA’s programs. 

2) Technological innovation is changing SBA’s private sector partners’ business practices. 

3) The lending industry has undergone radical restructuring amid rapid groivth and even 
more unanticipated changes may be on the horizon with the last year’s passage of the 
Gramm-Leach banking law by Congress. 

4) Declining SBA personnel levels. 

5) The passage of Clinger-Cohen Act of 1996. 
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6) SBA’s financing system does not comply with the posting rules contained in the 
Standard General Ledger, and SBA’s loan accounting system does not adequately 
capture budgeting data in a manner that facilitates preparation of financial statements 
and reports. 

7) The directives set forth in the 1997 SBA Reauthorization Act (PL 105-135). 

PRIVATIZATION OF SBA FUNCTIONS 

In the not too distant past, SBA field offices reviewed the creditworthiness of each loan 
before guaranteeing it, and then serviced and liquidated each loan that went into default. Today, 
SBA has centralized many loan processing and servicing functions. The Agency’s Preferred 
Lender Program (PLP), SBAExpress, and Premier Certified Lender Program (PCLP) delegates 
credit decisions and other loan making and servicing responsibilities to its most qualified lenders. 
SBA relies on the lenders’ credit analysis and only reviews PLP and SBAExpress loans for 
eligibility. SBA also performs only a limited credit review on loans submitted under the 
LowDoc program. The LowDoc program allows lenders to submit a streamlined application for 
loans of up to $150,000 and to receive a response from SBA within 36 hours. 

In 1999, about 75 percent of all business loans were made by our lending partners with 
no or limited credit review by SBA. The lenders also service and liquidate those loans. In 
accordance with the direction of Congress, SBA has also out-sourced 30 percent (or about $ 1 
billion) of disaster home loan servicing. This trend is expected to expand in the future. For 
instance, in FY 1999, SBA carried out its first asset sale of direct and purchased business loans. 
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This is the ultimate privatization of SBA’s servicing. The sale included 4,060 small business 
loans and realized $195 million in proceeds, which is $90 million more than the Federal 
government would have collected had it held the loans to maturity. 

As delegation of the loan-making process continues, SBA’s exposure on the loan 
guaranties becomes increasingly subject to the credit policies and actions of the participating 
lenders. In order to protect the taxpayer’s interests, we must have a system that allows us to 
identify, understand, and respond to their behaviors so we can ensure the long-term viability of 
SBA’s lending programs. The Small Business Reauthorization Act of 1 997 also required the 
SBA to increase its role in lender oversight. 

SBA’s basic program management and accounting systems were designed 20 years ago 
for direct loan making and have not kept pace with program delivery or technology. The current 
system does not readily provide management type information, such as identifying lender 
behavior that deviates from industry' norms or being able to determine the sensitivity of the 
portfolio to changes in the economy. This information is crucial to overall risk management and 
SBA’s continued ability to prudently deliver access to coital. 

Ultimately, the success of the SBA ‘s efforts to leverage private sector resources is 
contingent on the development and use of a sophisticated lender oversight and loan monitoring 
system. We will rffer to this effort as the Loan Monitoring System (or LMS) which constitutes 
Phase I of SBA 's overall system modernization efforts. 
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WHAT THE FUTURE HOLDS FOR SBA 

The Internet’s vast potential as a consumer-banking forum is beginning to be realized. In 
1998, 6.9 million households were banking online; and that number is expected to grow to 24.2 
million by 2002. Thirty-nine of the nation’s 100 largest consumer batiks now offer Internet bill 
payment, up from 17 a year ago.' And, Forrester Research projects that 40 billion dollars in loans 
will be originated online by 2001 . These changes are also taking place in business banking and 
SBA’s systems must become compatible with these industry innovations to enable seamless 
integration of SBA’s programs with the internal mechanisms of our lending partners. We must 
be able to accommodate electronic transactions at the request of our lenders. 

Another technological advancement impacting SBA and its business partners is the use of 
credit scoring. The private sector employs credit scoring to assist in making objective, 
standardized determinations on front-end risk on consumer loans, and increasingly on business 
loans. Recently, credit scoring models have increased in sophistication, allowing for a more in- 
depth, prospective analysis of borrowers w'ho previously would have scored poorly. 

By the summer of 2000, SBA will begin using customized credit scoring technology to 
expedite the decision-making workflow of its LowDoc centers. This approach was identified 
during the Benchmarks process, following a review of Freddie Mac’s systems. Specifically, a 
loan guaranty request receiving a credit score in the low risk range, that is when the score 
indicates a high likelihood of repayment, the credit scoring process will replace one of the two 

‘ The Industrj’ Standard. May 99, Thompson, Maryann 
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credit reviews now required for loan approval. 

The use of credit scoring must be balanced. SBA will continue to proceed to develop 
credit scoring methodology tailored to the needs of its clients which can serve as an appropriate 
evaluation tool. 

SIGNIFICANT CHANGES IN THE LENDING ENVIRONMENT 

It should be noted that while large, high-volume lenders generate a significant portion of 
SBA’s lending, smaller, less active lenders who tend to serve rural areas and economically 
disadvantaged areas still need to be served by SBA programs and services. For example, in FY 
99, seventy-two percent of our lenders originated five or fewer loans. Continued bipolarization 
of lending activity between high-volume multi-state lenders and less-active lenders in smaller 
markets may exacerbate the gaps in lending and make it more difficult for SBA to ensure 
nationwide access to capital. At the same time that the SBA accommodates multi-state lenders 
by streamlining operations and processing, it must provide customized service to newer, smaller 
and more traditional lenders and their borrowers in local markets. 


^ www.faiinieniae.com, press release 0264,”Autoniated Underwriting, Credit Scoring and trie Internet," 

^ As the credit score technology is customized for SBA terminology and score parameters may change 
Booz-Allen&Hamilton Benchmark Report Order No. SBAHQ-98-F-0293 
^ Booz-Allen&Hamilton Benchmark Report Order No. SBAHQ-98-F-0293 
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DECLINING PERSONNEL LEVELS 

All of these changes have occurred while SBA’s personnel levels have decreased. At the 
same time the number of our employees (excluding disaster stafi) has decreased over 20%, 
lending has tripled to where SBA has a portfolio in excess of $50 billion today. 

THE EIGHT REQUIREMENTS OF SECTION 233 OF THE SMALL BUSINESS 
REAUTHORIZATION ACT OF 1997 


In February 1997, SBA requested appropriations as part of its FY 1998 budget to begin 
replacing its outmoded legacy data systems and to make needed improvements in its loan 
monitoring capabilities. Congress appropriated $8 million for FY 1998, $8 million for FY 1999 
and $8 million for FY 2000. 

Section 233 of the Small Business Reauthorizafion Act of 1 997 laid out a series of eight 
planning steps which were to be followed in designing the new loan monitoring system. During 
the past two years, the Agency has worked closely with your staff, staff of the Full House and 
Senate Small Business Committees, our appropriators and the General Accounting Office (GAO) 
in order to carry out these important planning steps. 

In total SBA submitted twenty-eight deliverables to GAO for review. Many deliverables 
were ultimately revised to incorporate GAO’s recommendations for improvements. SBA 
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believes that the work done to fulfill these planning steps have laid the groundwork for a 
successful loan monitoring system and improved other aspects of the Agency’s information 
technology program. What follows is a summary of our progress on each of the eight planning 
steps. 

1 . Fully defining the system requirements using on-line, automated capabilities to the 
extent feasible. 

Working with contractor help (Booz-AIlen&Hamilton) and a forty-member team of 
senior SBA staff, SBA identified a number of improvements in our business processes. 
Requirements were identified for lender management, loan guaranty approval, risk management, 
portfolio management including asset sales and subsidy rate support, and Treasury cross- 
servicing. In addition, requirements were identified for data quality and information technology. 
These requirements are contained in a document entitled “SBA Systems Requirements for the 
Loan Monitoring System.” 

2. Identifying all data inputs and outputs necessary for timely report generation. 

SBA has completed the identification of all data inputs needed for the Loan Monitoring 
System. First, our contractor Data Networks developed a high level process chart which breaks 
down the system to three levels of functionality. Using this chart, as well as, the SBA 1995 
Information Architecture Report, the draft Information Technology Architecture (ITA) "To Be" 
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model, the BPR data elements groups, and data elements lists from SBA legacy systems, we 
documented the required LMS data inputs. Working with SBA staff from the Office of Capital 
Access, processing and service centers, field offices, and the OCIO, the contractor developed a 
logical (or conceptual) data model that depicts all of the data elements required as inputs to the 
LMS. 

3. Benchmark loan monitoring business processes and systems against comparable 
industry practices. 

I will detail this later as I describe the system SBA plans to implement as a result of these 
planning steps. 

4. Determine data quality standards and control systems for ensuring information 
accuracy. 

SBA took a two-step approach to completing the planning for ensuring that the LMS 
collects data that meets the needs of SBA management. First, Data Networks developed a Data 
Quality Guidance document that sets the goal of quality data in all SBA information systems. 
This guidance was used by the contractor to develop the Data Quality Management Plan to 
identify data quality standards and control systems for ensuring information accuracy for the 
LMS. The Plan identifies the activities SB.A will undertake to ensure information accuracy 
including: development of business, data, and application architectures, physical data base 
design, data load and migration, testing focusing on data quality, and inspection and data 
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configuration management during system operation. In addition, SB A also performed an 
analysis of the data quality issues it faces in its legacy systems. The Data Quality Plan focuses 
on ensuring that these kinds of quality issues are resolved and do not reoccur in our new system. 

5. Identify an acquisition strategy and work increments to completion. 

We have completed an acquisition strategy for the Loan Monitoring System and have 
identified six phases of implementation of the reengineered work processes and associated 
technology improvements. On December 21, 1999, Administrator Alvarez approved the 
recommendations of the BPR and the implementation strategy in an SBA policy document entitled 
‘Xoan Monitoring System (LMS) Recommendations” following its review by senior SBA officials. 

Contracts will be used as management tools and will be structured to motivate contractors 
to manage the work effectively while satisfying all contract requirements, to identify' 
performance problems early enough to take needed corrective actions 

6. Analyze the benefits and costs of alternatives and use to demonstrate the advantage of 
the final project. 

Following finalization of the BPR recommendations, SBA conducted a cost/benefits 
analysis for implementing the reengineering. The analysis, contained in "The Business Case for 
the Reengineered Loan Monitoring System," clearly shows that the Loan Monitoring System is 
cost effective in comparison with the current system as well as major alternatives. 
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7. Ensure that the proposed information system is consistent with the agency’s information 
architecture. 

The SBA has taken steps to ensure the proposed information system is consistent with the 
agency’s information architecture. With EDS Corporation support, the SBA has developed a 
strategy to reconcile LMS (as well as other technology projects that are underway) with the 
Enterprise Information Technology Architecture (ITA). The ultimate goal of this strategy is to 
effectively and efficiently align the use of information technology with strategic business and IT 
direction, while minimizing the impact of the SBA's evolution towards its target. 

As an integral part of the Systems Development Methodology (SDM), phase reviews and 
checkpoints are identified and planned. SBA will use these checkpoint reviews as a means to 
verify and ensure compliance to the ITA. Because the LMS is currently in the initiation phase of 
the project, there are only two elements of the SBA ITA that LMS should be reconciled with, the 
Business Architecture, and the IT Direction. 

8. Estimate the cost to completion through identification of essential cost elements. 

SBA has estimated the LMS cost of completion through the identification of essential 
cost elements. SB.A decided to structure the cost elements by SDM life-cycle phases. This 
approach allowed for focus on specific phases of the project life-cycle to better identify 
appropriate cost elements by purpose and outputs of each phase of the process. Assumptions 
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were documented for each-cost element. The cost elements were then summarized by life-cycle 
phase and categorized by type of cost. 

BENCHMARK STUDY 

As mentioned earlier, I will now go into detail about the results of the benchmark study 
and subsequent business process reengineering. Our office of the Chief Information Officer 
(OCIO), on behalf of the Capital Access/Financial Assistance Office, contracted with Booz-Allen 
&Hainilton to conduct a benchmark study in order to fulfill the requirements of the 1997 SBA 
Reauthorization Act. The purpose of “benchmarking was to identify the “best practices” of 
organizations that perform functions similar to those of the SBA. 

Booz-Allen&Hamilton emphasized to SBA at the begiiming of the benchmark study that 
some of the organizations examined have had significantly more resources available for the 
development of their systems and have spent several years in their development. 

Booz-AlIen&Hamilton also highlighted the fact that none of the organizations identified 
in the benchmark report perform precisely the same function as the SBA, Conventional lenders 
in the study do not have SBA’s mission of providing financing to those who do not have access 
to credit on reasonable terms. The quasi-govemmental entities we studied, like Freddie Mac and 
Fannie Mae, are also significantly different from SBA because they are involved in housing 
rather than commercial loans. This is mainly due to our role as a gap lender, which I discussed 
earlier. Nevertheless, their systems provided good models for the SBA to use in developing the 
Loan Monitoring System. 
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Booz-Allen&Hamilton first examined the current processes of the Agency’s loan 
programs to determine where improvements could be made. Their study concentrated on five 
functions: guaranty procedures, lender overnight, risk management, asset sales, and subsidy rate. 

As expected, the study concluded that there are performance gaps in all of the five 
iimctiona! areas. Within the performance gaps, there was one underlying concern that affected 
each of the five areas, i.e., the inability of capturing and analyzing information which may result 
in an increased taxpayer’s exposure to credit risk. Booz-Allen&Hamilton recommended that 
systems be developed that will obtain information at loan origination and then automatically and 
seamlessly transfer the information throughout the organization. The information captured 
directly from lenders at the inception of a guaranty will form the basis for all other future 
analysis. Loan performance data should also be gathered from lenders and analyzed to develop 
an understanding of loan-life behavior. The Risk Management function should use the captured 
information to determine the optimal underwriting criteria and portfolio exposure. The Lender 
Oversight function should use the captured information to analyze, and anticipate, lender 
behavior in order to ensure that lenders are acting in the best interests of the SBA, The Subsidy 
Rate Calculation function should use the captured information to predict more accurately the 
future cash flows of loans. The Asset Sales function should use the captured information to 
determine the optimal value for a portfolio of loans or guaranties. Each function is therefore 
dependent on receiving accurate, relevant, timely and consistent information on each guaranteed 
loan. 
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Connnercial lenders and other organizations which exhibit the best practices are those 
who have systems and processes in place that allow tunctions to be integrated based on three key 
concepts: consistency of loan information, relevance of information collected, and the seamless 
integration of information and business processes. The LMS incorporates these key concepts. 

It is important to note that SBA’s benchmark efforts are dynamic. SBA continues to 
benchmark innovative business practices and infonnation technology systems as they become 
available to ensure that potential business process improvement or commercial-off-the-shelf 
(COTS) technical solution is considered for its applicability to our Agency. 

BUSINESS PROCESS REENGINEERING 

SBA’s Business Process Reengineering (BPR) project represents an important step in the 
Agency’s modernization planning process. Booz-Allen & Hamilton, Inc. facilitated the BPR 
effort, with employees of their firm both guiding the work of the BPR teams and recording the 
teams’ ideas. The BPR study was conducted from December 1998 through June 1999 with a 
forty-member team comprised of a cross section of SBA field and headquarters staff most 
knowledgeable about small business borrowers and SBA's responsibilities. The team 
recommended incorporating technology advances that were not even available five years ago. 
The members were specifically instructed not to be limited to the traditional, nor constrained by 
current organizational structure. 
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FEASIBILITY ANALYSIS 

After the BPR, SBA followed the guidance of the General Accounting Office’s (GAO’s) 
Business Process Reengineering Assessment Guide and conducted a feasibility analysis of the 
BPR recommendations. The GAO guidance suggested that a feasibility study should balance the 
feasibility of each recommendation against the projected return on investment for the agency.® 

To this end, a panel of program experts, who were not part of the BPR team, reviewed the 3 8 
major BPR recommendations. Concurrently, the Associate Directors for Capital Access and 
Field Operations and their staffs along with the Chief Operating Officer analyzed and adjusted 
the recommendations to better reflect the agency’s mission as a "gap lender." Of major concern 
was ensuring that the new system did not have a negative impact on potential borrowers most in 
need of assistance and on those lenders not yet ready to move to an all-automated environment. 
The original recommendations called for complete centralization of loan processing. This 
approach was rejected because we could not ensure that the Agency 's mission could adequately 
be served without some degree of local service. Centralized processing may require a level of 
standardization that can cut out low-volume and new lenders. The team's other major risk 
concerns included the following: 

• Increased delegation of authority to lenders must be counterbalanced with stronger lender 
oversight. 

• The streamlining of underwriting could reduce the availability of information necessary to 


* GAO Business Process Rsengineering Assessment Guide 
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assess SBA’s potential.risk. 

• Full centralization of servicing reduces the ability to provide hands-on assistance to 
borrowers who are viable, but having difficulty. It also reduces the ability to quickly respond 
to regional needs. One example would be the recent fuel oil crisis in New England. 

• Centralization further removes the Agency from local knowledge. Commercial lending is 
very sensitive to local conditions, requirements of state law and associated litigation. 
Relations with local lenders, lenders new to SBA’s programs, and lenders that specialize in 
serving new markets cannot be cultivated to the same degree in a highly centralized 
environment. In addition, training, oversight and market analysis are also more difficult. 

• The manner in which a loan is processed and serviced has a direct influence on the kind of 
loans that are made. To the extent that SBA too closely mirrors the practices of commercial 
lenders, it runs the risk of reducing the value added to the small business sector. 

Ultimately, 30 of the 38 original major recommendations were adopted without change. 

The remaining eight were adopted with modifications to better meet our legislative mission as a 

gap lender, SBA will implement the actual recommendations issuing from these deliberations as 

part of Phase I of LMS development. The general themes of these 38 recommendations are: 

• We will become electronic with our lenders, pushing less paper and leveraging the tools 
we already have. 

• We will emphasize quality data and timeliness. 

• We will meet the need for greater oversight to monitor lenders' strict adherence to data 
collection and performance standards. 


17 



48 


• We will consistently enforce policies and regulations. 

• We will proactively perform risk management. 

• We will continue with asset sales and will strengthen our ability to do timely and 
accurate subsidy rate calculations. 

THE ITERATIVE APPROACH TO IMPLEMENTATION 

Now I will briefly discuss our approach to implementation of the Loan Monitoring 
System (LMS). The technical terni for the approach we have adopted is a “combination 
evolutionary incremental project structure.” In layman’s terms, we refer to our implementation 
method as the iterative approach. 

The incremental or iterative model is characterized by acquisition, development, and 
deployment of capability through a number of clearly defined system “increments” that can stand 
on their own. The number, size and phasing of the “increments” for the LMS project w'ere 
determined by the project team with significant input from SBA field representatives. 
Requirements for the LMS are documented both in Joint Financial Management Implementation 
Program (JFMIP) loan systems requirements and in the LMS Systems Requirements. The 
approach is evolutionary in that SBA will make use of prototypes whose full functionality may 
evolve over time. Testing a system built in smaller modules is also less risky. If something 
doesn't work as expected it can be fixed fairly quickly and less expensively. 

The first iteration of the new LMS initially will have the greatest impact on the PLP and 
SBA LowDoc loan processing. The anticipated completion date for Iteration One is Summer 
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2000. In Iteration One: 

• We will establish a set of core data elements that we will collect on all loans. 

The core set of data elements that have been identified is needed both for guaranty approval 
and throughout the life of the loan, including for risk management and lender oversight. 

Most of the best practice organizations reviewed during the benchmark practice standardized 
data collection followed by seamless and consistent use of the information for risk 
management. Freddie Mac uses its Loan Prospector® system to capture standard 
information directly from the lenders and move the information into the corporate computers. 
Bank of America uses the Merlin® system to capture standard information at its branch 
level, then uses the information to underwrite the loan and then transfers the infoTmation into 
the corporate loan accounting system. 

• The Internet will be the standard medium for submitting all applications. 

Ultimately, SBA will fully, leverage the Internet as a backbone for data submission. Freddie 
Mac has realized significant benefits by establishing their Loan Prospector® Internet based 
system as its standard medium for application data submission. In fact, Freddie Mac's 
participating lenders report that using Loan Prospector already is saving them $300 to $650 
per loan.’ 

• PLP, SBAExpress, PCLP, SB.ALowDoc, and Comraunitj’ Express ultimately will be 
submitted electronically. 


Freddie Mac's Guide To Automated Underwriting, Chapter 2, p. 3 
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SBA will encourage electronic transfer of guaranty requests and servicing actions. However, 
to ensure access to SBA’s programs by all small businesses, SBA will not turn do™ any 
transaction because of a lender's lack of electronic capability. We fully expect that, over 
time, lenders will move towards electronic-coiimierce and this issue will fade, however we 
intend to do what it takes to get capital to deserving small businesses. In the short terra, SBA 
plans on accommodating lenders’ varying levels of technical infrastructure and competency 
by establishing several automated data submission tracks. For example, highly automated 
lenders may use a file transfer via the Internet, whereas a less sophisticated lender may use 
Optical Character Recognition forms to fax an application to SBA. However, SBA will not 
turn a paper application away. 

Establishment of performance standards against which lenders will be reviewed . 

Lender performance standards will be established by a centralized lender oversight group. 
This is similar to what occurred at Freddie Mac and the Farm Credit Administration (FCA), 
where “best practice” lender performance standards were established by centralized lender 
groups. 

Lenders will be held responsible for submitting complete and accurate information on 
loan applications. 

This is ensured through a processing system that immediately screens out incomplete 
applications and identifies incomplete or invalid entries. The appropriate SBA field office 
will be notified of repeated deficiencies and rejections by lender so that they can undertake 
training. 
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• Authority to make eligibility decision will be delegated to PLP lenders. 

SBA will allow PLP lenders to sign an eligibility checklist and/or use an Internet automated 
eligibility tool and retain the results in their file as a substitute for the Agency’s eligibility 
determination. Lenders will be held accountable for eligibility determinations as part of the 
lender review process. Upon foil implementation, we expect PLP loans to be processed 
without SBA staff being involved in the processing. However, SBA will have staff available 
to consult on complex eligibility issues. 

ITERATIONS 2-6 

The following is a summary of the highlights of iterations 2-6: 

Iteration 2: We wiii expand the electronic application process to include regular 7(a) and 504 
loan programs. We will also test electronic loan files, digital signatures, and loan risk 
determinants. 

• This will minimize paper flowing between SBA and its lenders and within SBA. 

• Loan risk determinants will help SBA assess the risks associated with new loans and 
understand how the risks change over time. 

Iteration 3: We will continue to automate the internal work flow and develop on-line reports for 
SBA staff and management, 

• SBA staff and managers will have more accurate and timely information to make decisions. 
Iteration 4: We will add proactive risk management tools, a new loan servicing system, and an 
on-line system for lenders to update loan status information. 
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• It will be easier for lenders to provide loan data to SBA. 

• SBA will have analysis tools to perform proactive risk management of the portfolio. 

Iteration S: The system will include lender performance tracking and oversight. 

• The system will provide lender performance information to our lender oversight function. 
Iteration 6; We will complete the system with modules to support liquidation and litigation 
activities, enforcement of lender performance standards, and streamlined asset sales and subsidy 
rate calculations. 

• The cost of asset sales will be reduced. 

• Subsidy rale estimates will be more automated and require less data cleansing freeing 
resources to do more analysis. 

OVERALL AGENCY COMMITMENT 

SBA believes it has addressed most of GAO’s recommendations regarding the 
management of this project that are not specifically referenced in the eight planning steps, but 
critical to Clinger Cohen based planning. Early in the process, GAO representatives suggested 
that SBA's modernization efforts and more specifically the Loan Monitoring System Project, 
were devoid of an official “champion.” Since the last hearing on this subject in July 1998, SBA 
has designated Chief Operating Officer, Kris Maroy, as the senior-level official with overall 
responsibility, authority, and accountability for managing and coordinating the Agency's 
modernization projects. She works closely with our Chief Information Officer, Larry Barrett and 

‘ Freddie Mae's Guide To Automated Underwriting, Chapter 2, p. 3 
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our Chief Financial Officer Joe Loddo to ensure that the Clinger-Cohen mandates have been met 
and that critical tasks are completed on time and within budget. She also works closely with the 
Associate Deputy Administrator for Capital Access Charles Tansey and the Associate 
Administrator for Field Operations Robert Baskin to ensure that our program offices are well 
served by data improvements. We also want to ensure that the staff who will implement the 
LMS in the field are involved fully during the early stages of the project. In addition, Ms, Marcy 
and our program staff have held regular, in-depth briefings with GAO and your staff in 
November 1998, May and October 1999, to keep this Subcommittee fully abreast of our 
progress. Also, the Business Technology Investment Council, the SBA’s Information 
Technology Investment process, has endorsed the Loan Monitoring System Project. This 
Council reviews, controls and evaluates all SBA systems projects. 

Most importantly, SBA has established dynamic feedback mechanisms to analyze the 
concerns of its internal and external stakeholders and to proactively identify and define potential 
barri ers of the modernization effort. Some examples include: 

• In December of 1999, the agency began a series of ten regional training sessions to educate 
key field staff (District Directors, Deputy District Directors, Assistant District Directors for 
Economic Development) about business and system changes. 

• The LMS Project team regularly briefs its primary 7(a) and 504 trade groups, the National 
Association of Government Guaranteed Lenders (NAGGL) and the National Association of 
Development Companies (NADCO), on proposed process and system changes. In addition, 
project leadership conducts monthly meetings with NAGGL and NADCO technical advisory 
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representatives. 

• An Internet (www.sba.gov/banking/ino(iemization.html) and Intranet site is dedicated to the 
conmranicafion of modernization related issues. The sites include various two-way 
communication mechanisms for dynamic exchange of ideas between internal and external 
stakeholders. 

NEXT STEPS 

We are confident that we have carefully undertaken the planning necessary to ensure 
successful implementation. We are mindful of the mistakes that have caused other organizations 
to stumble. Using the incremental development approach, we wall increase the likelihood of 
success by developing, testing, and implementing manageable pieces of the system, ^Vhile we 
are mindful of possible risks, we are also aware of the greater risk of not proceeding. All of our 
planning has illuminated the exposure we currently face. As stewards of federal resources, our 
failure to proceed would be inesponsible and imprudent. 

Thank you for inviting SBA to discuss with you the automated Loan Monitoring System 
and again we appreciate your continued support for this effort. We will be happy to answer any 
questions you might have. 
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Good morning Mr. Chairman and members of the Committee. My name is Tony 
Wilkinson and I am President and Chief Executive Officer of the National Association of 
Government Guaranteed Lenders, Inc. or NAGGL. NAGGL represents nearly 700 
lenders and other program participants who cumulatively make approximately 80 percent 
of the 7(a) loans guaranteed by the Small Business Administration. We thank you for 
holding this hearing today and for recjuesting our input on SBA’s automation efforts. 

Period of Growth 

Over the last decade, the SBA 7(a) loan program has experienced tremendous growth. 
What once was a $1.5 billion loan program is now a $10 billion-plus program. Last fiscal 
year alone some 50,000 SBA 7(a) loans were made. In the early part of the 1990’s, only 
a small portion of 7(a) loans were processed using the preferred lenders program (PLP), 
meaning an SBA representative manually processed most 7(a) loans. But with increasing 
credit demands of small business, NAGGL questioned SBA’s mode of operation. With 
shrinking resources, the SBA needed to rely more on the private sector to deliver their 
programs. The SBA needed to manage lenders relationships rather than manage 
individual credit. And the SBA needed to upgrade their management information systems 
as their current system is over 20 years old and has not kept pace with technology. 

As we all know, this transformation is well under way at SBA. Last year, approximately 
75% of all 7(a) loans are processed under the PLP program or other limited review 
procedures. The SBA is shifting 7(a) program resources so that the Agency acts more like 
a regulator, focusing on lender oversight. The SBA is now better leveraging private 
sector resources, providing greater access to capital to small business, and doing so with 
fewer employees. 


Loan Monitoring System 

An integral part of SBA’s success will be the development of a new loan monitoring 
system. This is no easy task. The SBA must be able to deal with both large multi-district 
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lenders as well as community banks serving limited geographical areas. The needs of 
these lenders are very different and SB A should make sure that it meets the needs of both 
extremes and every lender in the middle. The SB A must gather sufficient data to manage 
its loan portfolio in a responsible manner, while not creating a reporting burden on either 
borrower or lender. 

NAGGL thanks the SBA for the on-going dialogue with our automation committee. We 
hope this continues. This will be critical as SBA nears the stage of refinement of their 
proposed .systems. Wc request the opportunity to provide feedback as to whether the 
system will actually work. We anxiously await the set of specifications - or data file 
elements - to be published soon by SBA. This is what lenders need to determine their 
ability to comply. 

NAGGL concurs that the Internet should be the standard medium for submitting loan 
applications and servicing actions. Reliance on the automated flow of information should 
create efficiencies both with the lender and SBA. We also appreciate SBA’s willingness 
to work lenders who are not technologically capable by agreeing to continue to accept 
applications by paper. 

NAGGL hopes that the SBA is having or will have dialogue with current SBA 
contractors to make sure that they can specifically integrate their computer systems with 
what the SBA is planning. Hopefully this will maximize results and there will be no 
duplication of efforts. 


Lender Performance Standards 

As equally important as the process for the collection of data is the establishment of 
performance standards by which lenders will be reviewed. The SBA has recently 
established the Office of Lender Oversight and it is our understanding that development 
of performance standards is one of high priority. NAGGL has long said that the SBA 
needed to be in the business of lender oversight. We hope to work with the SBA to 
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develop performance standards that are appropriate to protect SBA’s interests but also 
reasonable, fair and focused on compliance with SBA rules. 

Subsidy Rate Impact 

One of the stated uses of the data collected in the new Loan Monitoring System will be to 
“predict more accurately the future cash flow of loans.” NAGGL hopes this actually 
happens. For the last several years, the Administration has materially over-estimated the 
cost of the 7(a) program by u.sing a default estimate that is much higher than actual 
defaults. This means that borrowers are being charged fe.ss much higher than necessary. 
In just the last four years, the Office of Management (OMB), per the fiscal year 2001 
budget request, now says they overestimated the cost of the 7(a) program by a total of $1 
BILLION. Compared to the requested 7(a) program appropriation for FY 2001 of only 
$142.6 million, this is a serious problem. 

But even though OMB has reported they overestimated the cost of the program in the 
past, primarily due to excessive default estimates, they did not materially change the 
default estimate for FY 2001. OMB is still using a default estimate that we believe is 
more than 40% Mgher than necessary. A 40% decline in the default estimate in the 
subsidy model would mean a 7(a) program subsidy rate of approximately zero! 

NAGGL would appreciate any help this Corrunittee could provide in helping obtain a 
more reasonable and fair subsidy rate calculation for the 7(a) program. 

Thank you for the opportunity to appear today. 
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Mr. Chairman and Members of the Subcommittee: 

Thank you for inviting us to discuss the progress of the Small Business Administration (SBA) in 
performing the planning actions for its loan monitoring system, as mandated by the Small 
Business Reauthorization Act of 1997. After providing brief background information, my 
testimony today will discuss SBA’s progress in completing the mandated actions, our evaluation 
of SBA’s products completed thus far, the processes used to develop these products and manage 
key activities, and actions the agency needs to take to manage risks. 

SBA has made substantial progress in completing the eight mandated planning actions, but must 
still complete work for some actions and implement key functions to effectively manage the 
development of the loan monitoring system. SBA has benchmarked its business processes 
against those of leading organizations and has conducted a reengineering study to identify and 
select new processes to improve its operations. Using the results of these efforts, SBA has also 
started identifying the data needed for the proposed loan monitoring system, defining data 
quality standards, developing the information architecture, determining an acquisition strategy, 
defining systems requirements, and estimating the costs to complete the project. SBA has 
reported that all of the eight mandated planning actions are complete, except for two concerning 
the information architecture and systems requirements. 

Our analyses of SBA products for the planning actions have shown that the agency has made 
substantial progress. At the same time, some of the products lack one or more important 
elements, and there are critical steps that SBA has not performed. Several key functions— such 
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as configuration management, quality assurance, and system security — need to be established 
and implemented to effectively manage the project. 

Before beginning systems design and development, SBA will need to complete key planning 
actions — such as performing benefit and cost analyses of business process and system 
alternatives — for the mandated planning actions. It should also implement critical project 
management controls — such as those needed to ensure that system design addresses the security 
challenge posed by Internet-based access. Actions will be needed in such areas as these if SBA 
is to effectively manage the risks it will encounter in the systems development process. 

In commenting on a draft of this testimony, the deputy administrator and other SBA officials told 
us that they recognize the benefit of the actions we suggest to improve project management. 
However, they said, the risks from not fully completing such actions before system development 
should be weighed against the risks and opportunity costs associated with delaying the 
implementation of a system that would help oversee SBA’s guaranteed loan portfolio. They 
added that the first system increment they plan to develop will assist them in further defining the 
requirements for the entire system, and therefore they need to proceed with it expeditiously. 

BACKGROUND 


SBA’s need to monitor the activities of lenders who help deliver its programs has increased 
significantly in recent years. Annual loan approvals for the 7(a) General Business Loan 
Guarantee Program and the section 504 Certified Development Company Debenture Program 
have almost doubled since 1992, and the loan portfolio for all its programs now exceeds $40 
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billion. During that same time, SB A has decreased its staff by 20 percent and shifted to lenders 
the responsibility for key loan origination, servicing, and liquidation functions. Lenders now 
originate about 75 percent of new loans with little or no involvement by SBA in the eligibility 
and credit approval processes. 

To enhance its capabilities for loan and lender monitoring, SBA has proposed improvements to 
its automated systems, lender oversight, and risk management infrastracture. The purpose of 
SBA’s proposed loan monitoring system is to use technology and new processes to manage its 
loan portfolios, identify and effectively mitigate risks incurred through loans guaranteed by SBA, 
implement oversight of internal and external operations, and calculate subsidy rates. 

After reviewing SBA's basis for this request, we reported in June 1997 that the agency had not 
undertaken the essential planning needed to develop the proposed loan monitoring system. ' The 
Congress subsequently enacted provisions in the Small Business Reauthorization Act of 1997 
that required the SBA Administrator to perform and complete eight planning actions to serve as 
the basis for funding the development and implementation of the computerized loan monitoring 
system. The act also required SBA to report by June 2, 1998, on its progress in completing the 
planning actions. 


^ Small Business Administration: Better Planning and Controls Needed For Information Systems 
(GAO/AIMD-97-94, June 27, 1997). 
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As required by the act, in June 1998 we commented on SBA’s report.^ We reported that while 
SBA had formed a team for the loan monitoring system in December 1997, it had not yet 
completed any of the eight mandated actions. SBA’s report included a project plan, laying out its 
approach for addressing these actions. Work on the first of the required planning actions was 
begun in May 1998 and, according to the project plan, SBA was to complete work on the last of 
the eight mandated actions in August 1999. 

In July 1998 we testified that SBA’s project plan delineated the project’s goals and 
objectives, resource requirements, quality standards and control systems, assumptions, 
methodologies, work breakdown structure with timetable for completion of tasks, and 
estimated costs. ^ The plan estimated that a staff of 18 would be needed for the first phase of 
the project, which was to address the eight mandated planning actions, and scheduled 
completion of the mandated actions by the end of August 1999. 

While development of the project plan was a good start, we also testified that SBA faced 
formidable technical and management challenges and risks in executing the plan, including 
• establishing software project management capability while undertaking its largest 
information technology project ever; 


^The act required us to evaluate and report on SBA’s compliance within 28 days of receipt of 
SBA's report. Accordingly, we issued Small Business Administration: Mandated Planning for 
Loan Monitoring System Is Not Complete (GAO/AIMD-98-214R, June 30, 1998). 

^ Small Business Administration: Planning for Loan Monitoring System Has Many Positive 
Features But Still Carries Implementation Challenges (GAO/T-AIMD-98-233, July 16, 1998). 
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• using methodologies and practices for the first time while conducting a large, complex 
project; and 

• implementing the loan monitoring system without having an information technology 
architecture in place. 

SBA acknowledged these challenges and coiranitted to providing the loan monitoring 
system project with the necessary management support. 

To perform the planning for the loan monitoring system and conduct related modernization 
activities, SBA was appropriated $8 million annually for fiscal years 1998, 1999, and 2000. 
According to loan monitoring system project data, SBA used about $1 million in fiscal year 1998 
and $0.7 million in fiscal year 1999. For fiscal year 2000, SBA plans to use about $2 million for 
contractor project support, SBA staff, and travel costs; and about $8.5 million for infrastructure 
acquisition and system development activities. 

OBJECTIVE. SCOPE. AND METHODOLOGY 


As you requested, our overall objective was to evaluate SBA’s efforts to complete actions 
required by the Small Business Reauthorization Act of 1997 in accordance with required and 
generally accepted systems development practices. 

We conducted our work at SBA’s headquarters in Washington, D.C., from August 1999 through 
February 2000, in accordance with generally accepted government auditing standards. In our 
analyses of SBA’s products for the mandated actions, we used the methodologies and criteria 
that SBA officials said they used in performing their work and preparing the products, as well as 
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guidance issued by the Office of Management and Budget, the General Services Administration, 
the Institute of Electrical and Electronics Engineers, Inc. (IEEE), and our office that are 
applicable to the mandated planning actions. Our analyses of the products were performed to 
assess the structure, general content, and processes used in the planning actions. Detailed 
analyses could not be performed on all SBA products because many were only recently provided 
to us and time constraints precluded an opportunity to discuss these products and the processes 
used to produce them with cognizant SBA officials. We provided a copy of our draft testimony 
to SBA officials; we received comments from them, and made changes as appropriate. 


SBA HAS MADE SUBSTAINTIAL PROGRESS 
IN COMPLETING MANDATED ACTIONS 

SBA has completed 17 products for the eight mandated actions and has prepared 3 additional 
draft products. Table 1 summarizes the status of SBA’s products for the eight mandated actions. 
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Table 1: Status of Products for Mandated Actions as Reported bv SB A. as of 
February 23. 2000. 


Mandated Action 

SBA Product 

Statu.s of 
Product 

Benchmark loan monitoring 
business processes and systems 
against comparable industry 
processes and, if appropriate, 
simplify or redefine work 
processes based on these 
benchmarks 

Benchmaric study 

Final 

Business process reengineering study 

Final 

Feasibility analysis of recommendations 

Final 

Analysis of “as is” baseline cost and time 

Final 

Concept of operations 

Final 

Implementation strategy 

Final 

Analyze the benefits and costs 
of alternatives and use them to 
demonstrate the advantages of 
final project 

Business case for reengineering 

Final 

Ensure that proposed 
information system is consistent 
with agency's information 
architecture 

“As is” information technology architecture 

Final 

Technology policy statement 

Final 

Enterprise information technology architecture 
report 

Draft 

Gap analysis, migration strategy, and transition 
plan 

Draft 

Plan to synchronize loan monitoring system with 
information technology architecture 

Final 

Identify all data inputs and 
outputs necessary for timely 
report generation 

Needs statement (logical data model) 

Final 

Determine data quality 
standards and control systems 
for ensuring information 
accuracy 

Data quality guidance 

Final 

Data quality issues 

Final 

Data quality management plan 

Final 

Fully define the requirements 
for the system that uses on-line, 
automated capabilities to the 
extent feasible 

Statement of need for the loan monitoring system 

Final 

Systems requirements 

Draft 

Identify acquisition strategy and 
work increments to completion 

Acquisition strategy 

Final 

Estimate cost to system 
completion, identifying 
essential cost elements 

Needs statement (total cost to completion) 

Final 
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SBA officials advised us on February 23 that they expected to complete the remaining actions by 
March 2CXX) and then proceed to design and develop the first increment of the proposed system. 


ACTIONS STn.L NEEDFD FOR KEY ITEMS 


Our analyses of SBA products for the planning actions reveal that the agency has made 
substantial progress. At the same time, SBA had not completed some critical steps in preparing 
the products, and key products did not contain one or more important elements. For many of 
these missing or incomplete items, SBA plans to contract for their completion. 

Benchmarking and Business Process Reengineering Are Complete 
Except for Costs and Performance Measurement Data. 

Analysis of Alternatives, and Implementation Plans 

SBA conducted a benchmark study and reported its results in December 1998. Benchmarking is 
the comparison of core process performance with other components of the agency or 
organization (internal benchmarking) and/or with leading agencies or organizations (external 
benchmarking). Best practices include the processes, practices, and systems that perform 
exceptionally well in specific areas of public and private organizations. Benchmarking provides 
a means of establishing a compelling business case for change. It should identify more efficient 
and effective processes for achieving intended results, and suggest goals for program output, 
product and service quality, and process improvement. 
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SBA’s contractor used a seven-step benchmarking process to evaluate SBA business gaps with 
similar organizations for five loan management functions. The functions benchmarked were risk 
management, lender oversight, guaranty procedures, subsidy rate calculation, and asset sales. 
These functions were benchmarked against the practices of 1 1 federal and private-sector 
organizations. 

The benchmark report identified standard industry or “good” practices and showed a significant 
gap between SBA and benchmark partners’ practices for each of the management functions. The 
report also contained suggestions that senior management needed to “buy in” to the 
reengineering process, communications plans needed to be developed, systems requirements 
needed to be preliminarily defined, and training plans needed to be examined. 

In evaluating SBA’s benchmark effort, in May 1999'' we reported that it was an important first 
step in SBA’s actions to develop a loan monitoring system. In general, the benchmarking 
methods used were consistent with accepted practices and the benchmarking methodology was 
followed at a high level. However, the study had a number of weaknesses, the most significant 
being that it did not produce cost and performance measurement data for SBA and the 
benchmark partners’ processes. SBA agreed with our analysis and stated that it planned to 
collect additional benchmarking information during its business process reengineering activities. 


‘'Small Business Administration: Enhancements Needed for Loan Monitoring System 
Benchmark Study (GAO/AIMD-99-165, May 14, 1999). 


9 



69 


Because the benchmark study identified wide gaps between SBA’s business processes and the 
best practices of the benchmark partners’ practices for each of the management functions, SBA 
decided to pursue business process reengineering for each of the five SBA areas that were 
included in the study. Business process reengineering is an approach for redesigning the way 
work is done to better support the organization’s mission and reduce costs. Reengineering 
identifies, analyzes, and redesigns an organization’s core business processes with the aim of 
achieving dramatic improvement in critical performance measures such as cost, quality, service, 
and speed. 


The puipose of SBA’s business process reengineering (BPR) study was to analyze the current 
business practices within five functional areas of the organization, and develop new, more 
effective processes, supported by modernized, state of the art, information technology systems. 
The five functional areas addressed in the study were the following; 

Guaranty Procedures encompass the full life cycle of a loan, from application through 
payment in full or liquidation, with three major subprocesses: 

• Processing: encompasses application, approval, and closing 

• Servicing: includes all loan actions handled through payment in full 

• Liquidation: includes the process of recovering value from defaulted loans 

Lender Oversight is composed of three main functions: (1) communicating to lenders 
about policies, procedures, and standards of performance; (2) monitoring of lender 
performance; and (3) taking enforcement action when lender behavior and/or 
performance deviate from accepted standards. 
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Risk Management is the process by which SBA monitors its loan portfolio, tracks 
lenders and borrows and oversees the management of the portfolio to keep losses to an 
acceptable level. 

Subsidy Rate is an estimate of the subsidy cost of SBA's guaranteed and direct loan 
programs as a percentage of the total level of commitment. 

Asset Sales is composed of the processes used to sell SBA loan assets, including direct 
loans and repurchased guaranteed loans, to private investors. 

The SBA BPR team, with facilitation support from contractor staff, analyzed the best practices of 
the industry and made recommendations for SBA’s systems modernization primarily from the 
standpoint of maximizing efficiency with the highest degree of automation. As a result of this 
analysis, the BPR report contained 38 recommendations for new elements or characteristics for 
SBA’s business processes. A few of the more significant recommendations were that SBA’s 
new business processes include 

• one set of core data elements for all loan programs, and one standard electronic channel for 
submitting all applications; 

• centralized processing of all guaranty applications; 

• lenders’ ability to directly access the SBA system to submit a servicing action request or 
report a unilateral action; 

• lenders, direct borrowers, and designated SBA personnel being able to view the real-time 
status of all loans; 

• liquidations being centralized in the servicing centers to achieve economies of scale in labor 
and technology; 


11 



71 


• continuous capturing of lender performance information and electronic analysis for early 
warning of potential changes in lender performance; and 

• performance information collected through the new lender monitoring system and lender 
reviews providing the necessary base of information to facilitate informed decisionmaking. 

To decide which of the recommendations would be adopted in whole or in part, SBA formed a 
team that analyzed the risks and barriers associated with their implementation. Based on this 
analysis, the SBA Administrator fully adopted 30 of the 38 recommendations and adopted the 
remaining eight with modifications. For example, the recommendation to centralize the 
processing of all applications was modified to centralize the processing for programs that 
represent about 75 percent of all guaranteed loans. 

SBA’s contractor followed a methodology that conforms with generally accepted practices. 
However, as acknowledged in the report, key cost and performance measurement data — needed 
to compare and analyze proposed processes against current — were not collected during the BPR 
study. According to generally accepted practices, a performance-based and risk-adjusted benefit 
and cost analysis of alternatives being considered for each business process is needed to support 
the final selection of processes to implement.^ Accordingly, the BPR report recommended that 
SBA perform an activity-based cost analysis to provide critical data in evaluating current 
practices. SBA officials subsequently told us that they would produce a business case that would 
support their selection of new business processes. SBA did prepare this business case but it did 

^The generally accepted BPR practices cited here are taken from our Business Process 
Reengineering Assessment Guide (GAO/AlMD-10.1.15, April 1997). 
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not include benefit and cost analyses of alternatives being considered for each business process. 
Without analyzing benefits and costs, SBA increases the risk that the most effective and efficient 
business processes will not be selected. 

SBA also has not yet developed an implementation plan for the new business processes as 
required by generally accepted BPR practices. It developed an overall strategy for implementing 
the new business processes, but did not develop a detailed plan that lays out the critical elements 
and milestones for implementing them. SBA should consider formulating such a plan before it 
starts developing the first segment of the new system to ensure that the development and 
implementation of supporting information systems will be synchronized with the implementation 
of new business processes. 

Loan Monitoring System Is Intended to Provide 

Electronic Data Collection and 

Ready Access to a Comprehensive Data Repository 

Based on the results of its BPR study, SBA has developed a general description of the new loan 
monitoring system. The system is to be used by program managers and staff in headquarters, 
loan processing and service centers, field offices, financial operations, lenders, and external 
service providers under contract to perform specific portfolio support tasks. The system is 
expected to be “on-line to all users around the clock.” Internally, SBA staff are to have all 
necessary data available through a loan system that provides access to records from anywhere in 
the agency, while externally the system is expected to allow lenders to view their own portfolios. 
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SBA plans to have the loan monitoring system include a “virtual private network” using high- 
speed communications based on the Internet and dial-up access for smaller lenders, a security 
system that requires prior identification and approval of users, and high-level encryption of all 
messages. Because the Internet is a public network, SBA states that it will require authentication 
of lenders and SBA staff as they try to initiate access to the system. 

In addition to the network, the system is expected to integrate a secure Weh site and a 
technologically advanced system of data, applications, and processes. Requests for loan 
guarantees are to be submitted electronically, either through a formatted file transfer or on-line 
entry into the system. The loan monitoring system is also expected to have a comprehensive 
central data repository to support early warning systems, exception reporting, management 
reporting, decision support, ad hoc reporting, operational reponing, and financial management 
reconciliation. The central data repository is also considered to be the key to providing early 
warning systems for lender oversight and risk management functions. 

SBA has decided to design and develop the loan monitoring system in increments. According to 
the agency, the first increment will include the establishment of a standard set of data elements 
for loan guarantee applications and the electronic processing of applications for part of its loan 
guarantee programs. However, SBA has not yet provided us with key documents related to this, 
such as a description of the system design, documentation on the make or buy decision, proposed 
acceptance criteria for contract deliverables, and project plans. 
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Benefit-cost Analyses Have 
Not Yet Been Performed 


A benefit-cost analysis is a generally accepted method for comparison of alternative means of 
meeting a specific objective. In its simplest form, benefit-cost analyses should identify 
alternatives, determine the benefits and costs of each alternative, and recommend the most cost- 
effective alternative. 

SBA’s business case analysis^ describes the current system, discusses proposed system changes, 
identifies alternatives for the proposed loan monitoring system, and presents a benefit-cost 
analysis showing that the benefits associated with the new loan monitoring system are greater 
that the increases in costs for investment, maintenance, ongoing operations, and related items. 
SBA estimated that the new system would produce, by the end of fiscal year 2006, cumulative 
cash savings of $147 million. In its analysis, SBA considered — but dismissed — alternatives 
such as the privatization and outsourcing of loan monitoring functions to the private sector, 
noting that “SBA already has accomplished most of what can be done in terms of privatization.” 

SBA considered five system alternatives. It concluded that two of the alternatives — continued 
use of the current system and making improvements to the current system — were not viable 
because the current system is completely outmoded in both functionality and technical design. 
SBA noted that the remaining three alternatives — using standard commercial-off-the-shelf 


^The Business Case for the Reengineered Loan Monitoring System, LMS. VI. 1.006, February 

2000. 
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(COTS) software, standard COTS software with custom-made software, and custom-made 
software alone — will be analyzed at a later point. 

Before beginning system design, SBA should perform benefit-cost analyses of all identified 
alternatives, determine the benefits and costs of each alternative, evaluate alternatives by 
comparing their benefits and costs, and select the best alternative for implementation. This will 
increase the probability that SBA will obtain a system that meets its needs at the lowest cost. 

SBA’s Information Architecture Is Incomplete 

An information technology architecture is a blueprint — consisting of logical and technical 
components — to guide and constrain the development and evolution of a collection of related 
systems. At the logical level, the architecture provides a high-level description of an 
organization's mission, the business functions being performed and the relationships among the 
functions, the information needed to perform the functions, and the flow of information among 
functions. At the technical level, the architecture provides the rules and standards needed to 
ensure that the interrelated systems are built to be interoperable and maintainable. These include 
specifications of critical aspects of component systems' hardware, software, communication, 
data, security, and performance characteristics. 
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SBA has analyzed and documented' its existing architecture, defined the future — or target — 
architecture,* and analyzed the gaps between the two. The gap analysis^ forms the basis for 
development of a migration strategy to move from the current systems to the new system. 
However, SBA has not fully documented the current systems in the existing architecture, and has 
not completed its target information technology architecture. 

To deal with the incomplete architecture, SBA has developed an approach'® to maintaining 
consistency between the SBA information technology architecture and proposed loan monitoring 
system. This approach — which requires that the system under construction be mapped to the 
partially defined target architecture — increases the risk that the loan monitoring system would 
not be seamlessly integrated with the SBA target architecture. To address this increased risk, 
before beginning system design SBA should consider developing and including the rules and 
standards needed to ensure that the interrelated systems are built to be interoperable and 
maintainable in its information technology architecture. These include specifications of critical 
aspects of component systems' hardware, software, communication, data, security, and 
performance characteristics. 


^SBA Existing Information Technology Review, Capability, and Cost Analysis, Version 1.3, November 9, 
1998. 

Information Technology Architecture (draft). Final Version 1.0, October 1999. 

®SBA Target ITA Gap Analysis Assessment and Action/Migration Plan (undated draft). 

’®SBA Plan to Reconcile On-going Loan Monitoring System Development with In-process 
Information Technology Architecture Development, September 1999. 
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Data Inputs and Outputs Are Necessary for Timely Report Generation 

Requirements definition begins with high-level requirements and ends with detailed 
requirements prior to system design. High-level requirements for reports need to be consistent, 
and validated to a level of detail sufficient for defining acceptance criteria. System outputs, 
which consist of reports and files to satisfy the organization’s information needs, must be 
precisely defined prior to design. The inputs needed to produce these specific files, and reports 
are then defined in detail. 

SBA identified a sample of current reports, including reports now being produced by local 
systems and several reports being produced by the mainframe system, but has not identified 
high-level requirements for all internal reports. Before initiating system design for each 
increment, SBA should consider identifying the high-level requirements for all internal reports. 
In addition, it should define detailed input and output data elements necessary for the timely 
generation of reports. 

Data Quality Standards Still Need Schedule. Resource Allocation, and 
Business Process Measures 


Plans for improving data quality should include the definition of data quality standards, the 
development of quality measures, and the assessment impact of inaccurate data on business 
units. The plan for improving data quality should also have a schedule of activities and 
resources that are identified and allocated. 
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SBA developed a data quality plan and a conceptual data model that includes data quality 
information. The data quality plan is a strategy paper and, as such, provides a framework for 
pursuing data quality goals and contains guidelines for developing and maintaining data quality. 
For example, it discusses data migration actions to cleanse data in current systems. However, it 
does not identify the business priorities with respect to near-term and long-term requirements for 
data quality improvement, or provide a schedule of planned actions to improve data quality. 

Before beginning design, SBA should consider completing the definition of specific data quality 
standards, developing a schedule of planned actions to improve data quality in the current 
systems, and implementing data quality measures for the new loan monitoring system. 

Some System Requirements Are Yet To Be Defined 

In general, industry and federal practices for systems requirements include system life 
expectancy; functions and capabilities of the system; business, organizational, and user 
requirements; computer resource requirements; design constraints; security requirements; 
operations and maintenance requirements; human-factors engineering requirements; and 
compliance standards and procedures. The systems requirements should be documented and 
specify the methods used to ensure that each requirement has been met. It is essential for a 
requirement to have characteristics that can be verified and assessed throughout the system 
development life cycle. Methods of verification include inspection, testing, demonstration, and 
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analysis. All practices involving the creation, changing, or verification of requirements must 
maintain requirements traceability." 

SBA has drafted a systems requirements document that defines requirements for each function in 
the loan monitoring system, cross-references data bases to loan monitoring system business 
processes, identifies some of the reports by user and purpose, and includes sections required by 
the SBA methodology. However, some areas of systems requirements are not complete. For 
example, the systems requirements document does not specify capacity and performance 
requirements. Accordingly, before proceeding with system development, SBA should define its 
system capacity and performance requirements. 

Acquisition Strategy Awaits Final Selection of Implementation Alternative 

An acquisition strategy allocates risk between the government and contractor, effectively uses 
competition, ties contract payments to accomplishments, and takes maximum advantage of 
commercial technology. SBA’s acquisition strategy explains the approach for developing the 
loan monitoring system, identifies project increments, and establishes a risk management 
approach. In line with the model just described, it allocates risk between the government and the 
contractor, uses competition, ties contract payments to accomplishments, and takes maximum 
advantage of commercial technology. 


"a requirement is traceable if its origin is clear and if it facilitates the referencing of each 
requirement in future development . 
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In addition, SBA has taken action to mitigate acquisition risk, by selecting an incremental 
approach to systems development. Under this approach, cost and schedule risks will be managed 
by revisiting cost, schedule, and project objectives after the first increment. For each business 
function, SBA has identified whether automated solutions are available from vendors or 
government sources, whether business functions can be outsourced, and whether business 
functions can be developed as customized applications. However, in documenting this 
information, SBA does not identify sources for each approach, nor does it explain why it 
believes that 40 percent of the functions must be custom-developed and therefore cannot be 
outsourced or purchased. Because the risk and cost generally increase as the proportion of 
customized components increases, it is important that SBA have a sound, justified basis 
explaining its rationale for this. 

Cost to Completion Substantially Set 

SBA has substantially complied with this requirement. In documenting its compliance with the 
requirement to estimate the cost to completion, SBA provided us with its cost-to-completion 
document. The cost estimate was derived from its business case analysis. 
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Table 2: Loan Monitoring System Estimated Cost to Completion fSOOOl 


Cost Element 

FY 1998 

FY1999 

FY 2000 

FY 2001 

FY 2002 

Total 








Project startup 

$ 375 


$ 300 



$ 675 

Initiate project 

150 

$650 

1,160 

$ 950 

$ 600 

3,510 

Definition 

325 

50 

150 



525 

System design 

150 


350 



500 

Build system: 

Data scrub, Integrator, 
IV&V 



1,150 

1,200 

650 

3,000 

Iteration 1 



843 



843 

Iteration 2 



2,468 

800 

250 

3,518 

Iteration 3 



93 

675 


768 

Iteration 4 



928 

1,930 

200 

3,058 

Iteration 5 



218 

970 


1,188 

Iteration 6 



898 

1,530 

700 

3,128 

Data migration 



950 

1,150 

200 

2,300 

Infrastructure 



950 

1,900 

1,100 

3,950 

Evaluate 



84 

120 

120 

324 

Operate 



50 

150 

200 

400 








Total cost to completion 

$1,000 

$700 

$10,592 

$11,375 

$4,020 

$27,687 


Source; The SBA Loan Monitorins System Estimated Cost to Completion. Project Plan 
(Attachment) LMS.Vl.0.004, February 14, 2000. 


The total $27.7 million estimate includes about $4 million for infrastmcture, $9.3 million for 
software, $8.8 million for services, $2.5 million for support, $3 million for internal labor, and 
$0.3 million for other costs.’^ SBA has awarded a contract to refine the cost-to-completion 
estimate, including costs of work increments. 


SBA should continue to refine its cost-to-completion estimate following the completion of the 
benefit-cost analysis of alternatives and the selection of the best alternative for implementation. 


'^Numbers do not add due to rounding. 
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In addition, once SBA determines the life expectancy of the loan monitoring system, it also 
should develop and maintain a lifecycle cost estimate for the system and its components. 


KEY MANAGEMENT CONTROLS AND PROCESSES 
NEED TO BE IMPLEMENTED 


As stated earlier, we testified in July 1998 that SBA faced formidable technical and 
management challenges and risks in executing the plan, including establishing software 
project management capability, using methodologies and practices, and implementing the 
loan monitoring system project without having an information technology architecture in 
place. In following up on SBA’s actions to deal with these challenges, we found that the 
agency is just beginning to adopt and implement basic policies, processes, and tools needed 
to control and manage a major system development and acquisition project. These include 
project tracking and oversight, configuration management, quality assurance, and security 
requirements. 

Project Tracking and Oversight Is Planned 

Project tracking and oversight involves tracking and reviewing project accomplishments and 
results against documented estimates, schedules, and performance plans. A documented plan for 
the project is used as the basis for tracking systems development activities. Actual results and 
performance are tracked against the project schedule, and the project follows organizational 
policy for managing systems development. 
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SBA has adopted an agencywide systems development methodology that suggests that projects 
should use this type of project tracking and review. According to SBA officials, they intend to 
use this for the loan monitoring system. 

Configuration Management Plans. Policies, and Procedures Need to be Finalized 

Configuration management plans, policies, and procedures are a set of management controls over 
the composition of and changes to computer and network systems components and 
documentation, including software code documentation and project planning documents. 
Configuration management is essential to successfully managing complex information systems 
and ensuring their integrity throughout their life cycles. 

SBA has started to formulate and implement configuration management plans, policies, and 
processes for the loan monitoring system project. Finalizing these will provide SBA with further 
assurance of the success of the project. 

Quality Assurance Activities Are Planned 

Quality assurance involves reviewing and auditing systems development activities to verify that 
they comply with applicable procedures and standards. A software quality assurance group 
reviews project activities and audits software work products throughout the life cycle, and 
provides management with visibility as to whether the software project is adhering to its 
established plans, standards, and procedures. Compliance issues are first addressed and resolved 
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on the project level. For issues not resolvable within the project, the quality assurance group 
elevates the issue to an appropriate level of management for resolution. 

SBA has not yet established a quality assurance process to ensure that the loan monitoring 
system project and its activities comply with SBA policies, procedures, and systems 
development methodologies. However, it is planning to establish a technical review group 
whose purpose will be to review loan monitoring system project adherence to SBA standards 
outlined in the SBA systems development methodology. In addition, SBA is planning to 
contract for independent verification and validation to provide oversight of its systems 
development efforts. 

Loan Monitoring System Security and Privacy Requirements Are Not Fully Defined 

Security focuses on the ability to ensure the confidentiality, integrity, and availability of stored 
and processed data. Unsecured or poorly secured systems are highly vulnerable to external and 
internal attacks and unauthorized use. Security planning includes the identification of high-level 
security requirements, including mission, management, and technical security requirements; 
functional security requirements that cover users’ security and privacy needs; data-sensitivity 
analysis to identify data requiring special protection; and a security architecture that describes 
the security controls and relationships among the various system components. 

While SBA’s proposed Internet-based virtual private network may reduce telecommunications 
costs and provide easy nationwide access to loan monitoring system, the reliance on the Internet 
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as a key component of the system’s architecture brings unique security challenges that must be 
addressed early in the project’s life. However, SB A has not yet developed a security architecture 
for its target environment, updated its security operating procedures, or defined security and 
privacy requirements for the loan monitoring system.'^ Because security is a critical feature for 
the loan monitoring system, SBA should complete its security architecture and update its security 
operating procedures before it begins the design and development phase of the loan monitoring 
system. 

SUMMARY OF .ACTIONS NEEDED 


SBA has made substantial progress in planning for the loan monitoring system; however, the 
agency needs to take additional actions to manage the project’s risks. The issues I have outlined 
today pose considerable challenge, both in the area of timely completion of key planning 
activities and in the strengthening of project management processes and controls. 

In the area of planning actions, SBA should consider taking the following actions: completing 
the analyses of benefits and costs for alternative business processes identified through SBA’s 
business reengineering effort; performing benefit-cost analyses for systems alternatives; 
completing the part of its information architecture that specifies the rules and standards for 
interoperability and maintainability of interrelated systems; identifying requirements and data 
elements for reports; completing the definition of specific data quality standards; ensuring that 
systems requirements document include capacity and performance requirements; ensuring that 

'^Automated Information Security Program (undated), SOP 90-47. 
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sound justification exists for pursuing custona-developed functions; and estimating the cost to 
completion that are based on an analysis of the benefits and costs of system alternatives. 

In the project management area, SBA should strengthen its project management process and 
controls. These include putting in place project tracking and oversight capabilities; 
implementing configuration management processes; acquiring independent verification and 
validation for the loan monitoring system project and establishing an internal quality assurance 
function; and addressing the security challenge posed by Internet-based access to loan 
monitoring system functions and data. These processes and capabilities are essential to a major 
systems development and acquisition. 

Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that 
you or other members of the Subcommittee may have at this time. 
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